@cognigy/cognigy-cli (>=1.9.7, <=2.1.0), @forestadmin/agent (>=1.71.0, <=1.72.9) +13 more potentially affected by CVE-2026-26019 via @langchain/community (>=1.0.0, <=1.1.12)

@langchain/community NPM version =1.0.0, =1.9.7, =1.71.0, =1.1.0, =1.12.76, =0.0.1, =0.2.0, =0.0.16, =1.4.13, =1.0.24, =1.0.0, =3.1.0, =0.3.0, =0.0.210, =0.1.1, =0.1.2 Source cves: CVE-2026-26019 Source advisory: SNYK:JS-LANGCHAINCOMMUNITY-15268428...

First Malicious Outlook Add-In Found Stealing 4,000+ Microsoft Credentials

Cybersecurity researchers have discovered what they said is the first known malicious Microsoft Outlook add-in detected in the wild. In this unusual supply chain attack detailed by Koi Security, an unknown attacker claimed the domain associated with a now-abandoned legitimate add-in to serve a fa...

@cognigy/cognigy-cli (>=1.9.7, <=2.1.0), @forestadmin/agent (>=1.71.0, <=1.72.9) +13 more potentially affected by CVE-2026-26019 +1 more via @langchain/community (>=1.0.0, <=1.1.12)

@langchain/community NPM version =1.0.0, =1.9.7, =1.71.0, =1.1.0, =1.12.76, =0.0.1, =0.2.0, =0.0.16, =1.4.13, =1.0.24, =1.0.0, =3.1.0, =0.3.0, =0.0.210, =0.1.1, =0.1.2 Source cves: CVE-2026-26019, CVE-2026-27795 Source advisory: OSV:GHSA-GF3V-FWQG-4VH7...

CVE-2026-23689 Denial of service (DOS) in SAP Supply Chain Management

Due to an uncontrolled resource consumption Denial of Service vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution th...

CVE-2026-23689

CVE-2026-23689 involves an authenticated attacker with regular user privileges who can access the network to trigger a remote-enabled function module using an excessively large loop-control parameter. This leads to prolonged loop execution and uncontrolled resource consumption, resulting in a den...

CVE-2026-23689 Denial of service (DOS) in SAP Supply Chain Management

Due to an uncontrolled resource consumption Denial of Service vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution th...

SAP Supply Chain Management 安全漏洞

SAP Supply Chain Management is a supply chain management software developed by the German company SAP. There is a security vulnerability in SAP Supply Chain Management. This vulnerability stems from uncontrolled resource consumption, which may allow authenticated ordinary users with unauthorized...

BentoML < 1.4.34 Path Traversal

The version of the BentoML library installed on the remote host is prior to 1.4.34. It is, therefore, affected by a path traversal vulnerability: - BentoML's bentofile.yaml configuration allows path traversal attacks through multiple file path fields description, docker.setupscript,...

@kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.5.9), @machina.at/cli (>=19.24.1, <=19.43.0) +20 more potentially affected by CVE-2026-25724 via @anthropic-ai/claude-code (>=2.0.0, <=2.0.76)

@anthropic-ai/claude-code NPM version =2.0.0, =0.4.2-beta.2, =19.24.1, =1.0.0-broken, =0.0.1-rc.1, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =1.9.1, =1.9.1, =1.9.6 and more Source cves: CVE-2026-25724 Source advisory: OSV:GHSA-4Q92-RFM6-2CQX...

Compromised dYdX npm and PyPI Packages Deliver Wallet Stealers and RAT Malware

Cybersecurity researchers have discovered a new supply chain attack in which legitimate packages on npm and the Python Package Index PyPI repository have been compromised to push malicious versions to facilitate wallet credential theft and remote code execution. The compromised versions of the tw...

Chrysalis, Notepad++, and Supply Chain Risk: What it Means, and What to Do Next

When Rapid7 published its analysis of the Chrysalis backdoor linked to a compromise of Notepad++ update infrastructure, it raised understandable questions from customers and security teams. The investigation showed that attackers did not exploit a flaw in the application itself. Instead, they...

Mitsubishi Electric FREQSHIP-mini 安全漏洞

Mitsubishi Electric FREQSHIP-mini is an automatic power supply shutdown software developed by Mitsubishi Electric, a Japanese company. There are security vulnerabilities in the versions of Mitsubishi Electric FREQSHIP-mini from 8.0.0 to 8.0.2. These vulnerabilities stem from improper default...

@ai-growth/n8n-nodes-wordpress (>=0.2.0, <=0.6.12), @henry2323/n8n-nodes-calendar-tool-wrapper (0.1.4) +36 more potentially affected by CVE-2026-25051 via n8n-core (>=1.0.0, <=1.121.1)

n8n-core NPM version =1.0.0, =0.2.0, =1.0.1, =1.0.1, =0.21.8, =1.0.0, =1.0.0, =0.1.0, =1.0.1, =0.3.3, =0.1.3, =0.1.1, =1.2.0, =0.1.1, =0.4.1, =1.1.1 and more Source cves: CVE-2026-25051 Source advisory: SNYK:JS-N8NCORE-15223562...

Eclipse Foundation Mandates Pre-Publish Security Checks for Open VSX Extensions

The Eclipse Foundation, which maintains the Open VSX Registry, has announced plans to enforce security checks before Microsoft Visual Studio Code VS Code extensions are published to the open-source repository to combat supply chain threats. The move marks a shift from a reactive to a proactive...

PT-2026-6007

New security advisory deep dive. The openSUSE patches for Protobuf CVE-2026-0374 / 0994 aren't just routine updates—they're a case study in modern software supply chain risk. Read more: 👉 https://t.co/EBiImW9FLH Security https://t.co/J2lELRZjNc...

@kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.5.9), @netlify/agent-runner-cli (>=1.0.0-broken, <=1.58.3) +15 more potentially affected by CVE-2026-24887 via @anthropic-ai/claude-code (>=2.0.0, <=2.0.69)

@anthropic-ai/claude-code NPM version =2.0.0, =0.4.2-beta.2, =1.0.0-broken, =0.0.1-rc.1, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =0.11.1, =0.11.0, =1.0.0, =1.2.1 and more Source cves: CVE-2026-24887 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-15202067...

@kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.5.9), @netlify/agent-runner-cli (>=1.0.0-broken, <=1.58.3) +15 more potentially affected by CVE-2026-24053 via @anthropic-ai/claude-code (>=2.0.0, <=2.0.69)

@anthropic-ai/claude-code NPM version =2.0.0, =0.4.2-beta.2, =1.0.0-broken, =0.0.1-rc.1, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =0.11.1, =0.11.0, =1.0.0, =1.2.1 and more Source cves: CVE-2026-24053 Source advisory: OSV:GHSA-Q728-GF8J-W49R...

@circleci/agents (2.13.2-canary.8150572), @tessl/cli (>=0.21.0, <=0.21.2) +9 more potentially affected by CVE-2026-24052 via @anthropic-ai/claude-code (>=1.0.8, <=1.0.108)

@anthropic-ai/claude-code NPM version =1.0.8, =0.21.0, =0.2.0, =0.1.34, =1.8.0, =0.1.44, =0.0.22, =0.0.11, =0.0.27, =0.0.31 - locadex 0.0.2-alpha.1 Source cves: CVE-2026-24052 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-15202062...

@agishub/mcp (>=2.1.0, <=3.0.0), @anngdinh/remote-mcp-server-authless (0.0.0) +117 more potentially affected by CVE-2026-1664 via agents (>=0.0.43, <=0.2.35)

agents NPM version =0.0.43, =2.1.0, =0.4.0, =1.1.1, =0.2.0, =0.1.0, =0.0.1, =1.0.1, =0.2.0, =0.5.3 and more Source cves: CVE-2026-1664 Source advisory: SNYK:JS-AGENTS-15209148...

The Notepad++ supply chain attack — unnoticed execution chains and new IoCs

UPD 11.02.2026: added recommendations on how to use the Notepad++ supply chain attack rules package in our SIEM system. Introduction On February 2, 2026, the developers of Notepad++, a text editor popular among developers, published a statement claiming that the update infrastructure of Notepad++...