CVE-2026-32735

openapi-to-java-records-mustache-templates allows users to generate Java Records from OpenAPI specifications. Starting in version 5.1.1 and prior to version 5.5.1, the parent POM file of this project openapi-to-java-records-mustache-templates-parent, which is used to centralize plugin...

CVE-2025-52638

HCL AION is affected by a vulnerability where generated containers may execute binaries with root-level privileges. Running containers with root privileges may increase the potential security risk, as it grants elevated permissions within the container environment. Aligning container configuratio...

CVE-2026-31854

Cursor is a code editor built for programming with AI. Prior to 2.0 ,if a visited website contains maliciously crafted instructions, the model may attempt to follow them in order to “assist” the user. When combined with a bypass of the command whitelist mechanism, such indirect prompt injections...

Malicious Package

Overview chain-coremesh is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-33216

Impactful CVE-2026-33216 (NATS-Server) : In MQTT deployments using usercodes/passwords, passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed through monitoring endpoints. Affected versions are prior to 2.11.15 and 2.12.6; fixes are in 2.11.14 and 2.12....

FCC Bans New Foreign-Made Routers Over Supply Chain and Cyber Risk Concerns

The U.S. Federal Communications Commission FCC said on Monday that it was banning the import of new, foreign-made consumer routers, citing "unacceptable" risks to cyber and national security. The action was designed to safeguard Americans and the underlying communications networks the country...

Malicious code in chai-as-attached (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3334b8d2a1f3861b1427af8ae49ac714b72ab19d6a571835e6c84c5d4b83b1a The package chai-as-attached was found to contain malicious code...

Malicious code in chai-as-aligned (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bfc79b3c746510178bdaa8e79ecf903f3705e61a09a5846e263159301607f91 The package chai-as-aligned was found to contain malicious code...

Exploit for Deserialization of Untrusted Data in Facebook React

React2Shell-PoC-C...

Moderate: Red Hat Security Advisory: nginx:1.24 security update

An update for the nginx:1.24 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

PT-2026-26803

The Multi Post Carousel by Category plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides' shortcode attribute in all versions up to, and including, 1.4. This is due to insufficient input sanitization and output escaping on the user-supplied 'slides' parameter in the...

Malicious code in @validates-sdk/v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14f6dc99183ad11d3293d19966af14cd33cf7ed4ad00f3de9d6f07e5842a9234 The package @validates-sdk/v3 was found to contain malicious code. Source: ghsa-malware...

CVE-2026-32735

The CVE concerns the project openapi-to-java-records-mustache-templates and its parent POM. Between versions 5.1.1 and 5.5.1, the parent POM (used to centralize plugin configurations) uses maven-dependency-plugin to unpack arbitrary .mustache files from the same-version artifact. Although the par...

Malicious code in portal-lime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a61d5bfbd22f203a4a68f3329504312a967221d510ce7ceed02c663b0de8e002 The package portal-lime was found to contain malicious code...

Malicious code in node-intend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba5f9e681ba9ecd6ac8399dc29bec6a699bd3595529aaebb037a7a0f79204746 The package node-intend was found to contain malicious code...

Malicious code in libxmlrussia2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 742988acadb93f2a85625c677ab49a6e3bd1614b299c69781f7ba82fca23ad5f The package libxmlrussia2 was found to contain malicious code...

Malicious code in libxmljs2var-ctf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01c9273d9a31b1c550935b2367e8a3ba1bedb4668f432fec423a01bdc314ea0e The package libxmljs2var-ctf was found to contain malicious code...

Malicious code in collabs-merchants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c742b9fe98460e2c9a2ab91847c6ff1f1b753187de7d52c7d160dd99021b6e58 The package collabs-merchants was found to contain malicious code...

MAL-2026-1680 Malicious code in chai-promised-await (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4af3ac4bdf4f878612b66ee0cad227e2bef184fe763ff80478fc0905107d3edb The package chai-promised-await was found to contain malicious code...

Malicious code in @commonschema/blackstone-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6f3edc28bea0e512a6dcee373cec98f067d76a64791869cfe843a2434edca05 The package @commonschema/blackstone-core was found to contain malicious code...