Malicious code in waxed-slightly-weathered-cut-copper-stairs-3xt74ldh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 125aa8a7ecbe76dbb501f7fc47defca2480a50f4b7e38a7cdc848ff1c15b2994 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in desmos-graphing-l5t17nyz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c9ad99fa93d6470ff0e403af07ba26efa2a2c72dab859da20722eaa768d9d364 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in desmos-graphing-w7am2h4f (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a587a6a9d79a435737148758d763bbb316e529fac1e72eca1d57764886a442f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classlink-csh3v6cf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c4dac329ff5e34f65f8b47e3c1f6c0245bd2752fee6c0993b90f15b397c092ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-3a1zujw0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5eafb9932b14de66aa15f9850f0b8ef19f5964c521886d08812c9d883f68016f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in classlink-vulrfg00 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0dce79d9f109ae4132ce031ad16decf56259c490c10880bcde7f6886e85f5bcd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-ameyqv97 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a475aa608722e5a021edae81a8e2b4848eb991b51a9b2dead74446bb6466ae8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-40204

None None None No publicly available exploits are known...

MSC-2026-11519

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-11520

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to information disclosure (CVE-2025-14483)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed information disclosure security vulnerability Vulnerability Details CVEID:CVE-2025-14483 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.51,...

PT-2026-83132

Name of the Vulnerable Software and Affected Versions Akilli Ticaret Software Technologies Ltd. E-Commerce Pack versions 4.5.001 through 28082026 Description Improper neutralization of input during web page generation allows for Stored Cross-Site Scripting XSS, a condition where malicious scripts...

LLM-Based Agents for Software and Systems Security: Approaches, Applications, and Assessment

Software and systems security workflows are typically procedural: analysts inspect heterogeneous artifacts, form hypotheses, invoke tools, interpret outputs, and revise plans. Large language model LLM-based agents, which can plan, use tools, retain state, and revise actions across multi-step...

Adminer Code Execution

The vulnerability of Adminer’s database management software lies in improper external manipulation of file names or file paths. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-11754

Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-81101

The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted...

CVE-2026-81097

The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...

EUVD-2026-67135

Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-11747 Reflected XSS in Seres Software's syWEB

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Seres Software syWEB allows Reflected XSS. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2026-11747

Seres Software syWEB is affected by a Reflected XSS vulnerability caused by improper neutralization of user-supplied input during web page generation. The flaw affects versions through 27082026 . An attacker who lures a user into a crafted link can execute script in the victim's context, with a c...