CVE-2026-1699

In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pullrequesttarget trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to...

Former Google Engineer Convicted of Stealing AI Secrets for China

A 38 year old was convicted on seven counts of economic espionage and seven counts of theft of trade secrets following an 11 day trial...

CLEANSTART-2026-QJ89068 SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process

Multiple security vulnerabilities affect the external-secrets-fips package. SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process. See references for individual vulnerability details...

CLEANSTART-2026-JM84344 Within HostnameError

Security vulnerability affects the external-secrets package. Within HostnameError...

CLEANSTART-2026-DO54415 Within HostnameError

Security vulnerability affects the external-secrets package. Within HostnameError...

CVE-2026-1699

In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pullrequesttarget trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to...

CVE-2026-1699

In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pullrequesttarget trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to...

CVE-2026-1699

In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pullrequesttarget trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access to...

Ex-Google Engineer Convicted for Stealing AI Secrets for China Startup

A former Google engineer accused of stealing thousands of the company's confidential documents to build a startup in China has been convicted in the U.S., the Department of Justice DoJ announced Thursday. Linwei Ding aka Leon Ding, 38, was convicted by a federal jury on seven counts of economic...

PT-2026-5388

In the Eclipse Theia Website repository, the GitHub Actions workflow .github/workflows/preview.yml used pull request target trigger while checking out and executing untrusted pull request code. This allowed any GitHub user to execute arbitrary code in the repository's CI environment with access t...

CVE-2026-24742

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive information in staff action logs that should be restricted to administrators only. The exposed information includes webhook payload URLs and...

Malicious code in researchpoc2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 543f158149a74f451a6b81f0c088ec8bcfbfb019477a57c17c44da8e58e2df3d The package researchpoc2 was found to contain malicious code. Source: ghsa-malware f4dc24e7a14111cc2df68f08d7e66d1493e2c98b12d547140775f16bfe49f56c A...

MAL-2026-599 Malicious code in jwt-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4102b59becb214e216d479ce014231e41dd264560b48ef7750c7006a3c86e7d6 The package jwt-pack was found to contain malicious code. Source: ghsa-malware c16aba10441aad949bd96fd2a349f2f59d62bf56708394fd925b432c57e2c91b Any...

Malicious code in n8n-nodes-comfyui-illu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f55ef8a1d72164c700fe4a5c05d4fa8150e2162291f8a65f5505304b2aeb46b The package n8n-nodes-comfyui-illu was found to contain malicious code. Source: ghsa-malware...

MAL-2026-597 Malicious code in n8n-nodes-comfyui-illu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f55ef8a1d72164c700fe4a5c05d4fa8150e2162291f8a65f5505304b2aeb46b The package n8n-nodes-comfyui-illu was found to contain malicious code. Source: ghsa-malware...

Malicious code in wallet-icon-font (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a89aa304ab9d5d7a44ee3e88112f9e35b876ad03a87090749c929e882289c721 The package wallet-icon-font was found to contain malicious code. Source: ghsa-malware 319f118931c6d4b46c7bf09c9474dd23e24873b1c32f093f631cc3dccd10ec...

MAL-2026-598 Malicious code in wallet-icon-font (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a89aa304ab9d5d7a44ee3e88112f9e35b876ad03a87090749c929e882289c721 The package wallet-icon-font was found to contain malicious code. Source: ghsa-malware 319f118931c6d4b46c7bf09c9474dd23e24873b1c32f093f631cc3dccd10ec...

CVE-2026-24742

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive information in staff action logs that should be restricted to administrators only. The exposed information includes webhook payload URLs and...

CVE-2026-24742 Discourse staff action logs expose sensitive information to moderators

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive information in staff action logs that should be restricted to administrators only. The exposed information includes webhook payload URLs and...

EUVD-2026-4869

Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators can view sensitive information in staff action logs that should be restricted to administrators only. The exposed information includes webhook payload URLs and...