Malicious code in lacerta-ursa-process-epimetheus (npm)

Source: amazon-inspector 108481acf0733a6dcfa4494b50cff9fd397842b2c03148422adf1b8d22d76315 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kronos-sirius-process-koa (npm)

Source: amazon-inspector 1edc19892781e5698a861cfdaaf9cb484c281578a45fd8758876ddff8f2f484d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in koa-process-gatsby-stream (npm)

Source: amazon-inspector 798a18987a0275abf563f2f66f0c42262f0a090747f34fcd6f0305174adf9131 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kinetic-exec-spectron-webdriver-child-process (npm)

Source: amazon-inspector a7effbcd1496d9a2517931b273a2bd6b3fe910ed3cc3d39cb648b766711de01d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in key-tree-cron-serialize-process (npm)

Source: amazon-inspector 5ff78953ae8c70b79b3faaea4d21dacd0a7182c0942619a5916fe974dfedf448 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kappa-cache-process-byte-sudo (npm)

Source: amazon-inspector 6b8fa30fc7c162a6094a97409707dddf8e50e05a0d0106276d65c351e656ef2b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in juno-epimetheus-selenium-child-process (npm)

Source: amazon-inspector be603a6ccdba311fa78ba451f8072a751787808a917f9b9d7795778a7aac3627 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in juno-child-process-izar-betelgeuse (npm)

Source: amazon-inspector 884e74fd506fa1bc98cfbd4ce57585a43813d8be971e030658be9b01ea9b0e57 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CVE-2026-92061

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Incorrect boundary conditions in the Security: Process Sandboxing component...

CVE-2026-50291: Out-of-bounds Read

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to versions 3.0.16.0 and 3.1.11.0, processing a crafted BMP file through oiiotool or an application linked to OpenImageIO can reach BMP palette handling in...

CVE-2026-93393: Out-of-bounds Write

A heap-based buffer overflow exists in the TLS transport layer of the MongoDB C Driver when built with the Windows platform TLS backend. A remote endpoint that the client connects to can cause the driver to write uncontrolled data outside the bounds of a heap allocation while processing incoming...

CVE-2026-93380: Time-of-check Time-of-use (TOCTOU) Race Condition

Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-93378: Missing Authorization

Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. Chromium security severity: Medium...

CVE-2026-92956: Protection Mechanism Failure

vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default new VM sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling...

CVE-2026-92955: Improper Control of Dynamically-Managed Code Resources

vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host proto getter/setter through console.stdout and console.stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassin...

CVE-2026-92954: Uncaught Exception

vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions = 3.10.0 and = 3.11.7, Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary; only Promises created inside the sandbox are wrapped with a rejection-swallowing handle...

CVE-2026-92934: Protection Mechanism Failure

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized hos...

PT-2026-105516

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jxxv-8r27-vm4p. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary...

PT-2026-105468

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8686-vhfx-7r3j. This link is maintained to preserve external references. Original Description vm2 through 3.11.6 does not normalize node:-prefixed builtin specifiers when evaluating user-supplied negative deny...

PT-2026-105025

rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized HEADER or METHOD frame during client login and cause unsigned size t underflow in amqp handle input in librabbitmq/amqp connection.c. The parser subtracts HEADER SIZE, fixe...