CVE-2026-121448

Dockhand versions prior to 1.0.54 are vulnerable to a path traversal vulnerability (CWE-22) within the stack environment routes. Authenticated users can exploit this by double-encoding the stack name, specifically using %252e%252e sequences in the /api/stacks/[name]/env/raw endpoint. This flaw al...

Malicious code in @wagni_bot/wagni (npm)

The npm package @wagnibot/wagni is a supply-chain credential stealer disguised as a the campaign's own namesake handle SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...