cloudmesh-client (>=4.5.0, <=4.7.3), python-telegram-bot (5.3.1) +1 more potentially affected by CVE-2025-50181 via urllib3 (1.20.0)

urllib3 PYPI version 1.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on urllib3 and may be impacted: - cloudmesh-client =4.5.0, =4.7.3 - python-telegram-bot 5.3.1 - steem 0.18.4 Source cves: CVE-2025-50181 Source advisory: OSV:PYSEC-2026-1999...

connect-telegram-bot (>=1.0.0, <=1.0.1), nemo (>=3.9.0, <=3.9.1) +1 more potentially affected by CVE-2026-53877 via django (2.2.19)

django PYPI version 2.2.19 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - connect-telegram-bot =1.0.0, =3.9.0, =1.0.3, =1.0.6 Source cves: CVE-2026-53877 Source advisory: OSV:GHSA-CRHF-3PFG-W68W...

connect-telegram-bot (>=1.0.0, <=1.0.1), nemo (>=3.9.0, <=3.9.1) +1 more potentially affected by CVE-2026-53878 via django (2.2.19)

django PYPI version 2.2.19 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - connect-telegram-bot =1.0.0, =3.9.0, =1.0.3, =1.0.6 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...

connect-telegram-bot (>=1.0.0, <=1.0.1), nemo (>=3.9.0, <=3.9.1) +1 more potentially affected by CVE-2024-45231 via django (2.2.19)

django PYPI version 2.2.19 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - connect-telegram-bot =1.0.0, =3.9.0, =1.0.3, =1.0.6 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

django-oscar (>=1.1.0, <=1.1.1), django-oscar-telegram-bot (>=0.1.0, <=0.5.0) +2 more potentially affected by CVE-2023-4863 +1 more via pillow (2.7.0)

pillow PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-oscar =1.1.0, =0.1.0, =0.1.0, =0.1.1, =0.2.1 Source cves: CVE-2023-4863, CVE-2023-5129 Source advisory: OSV:PYSEC-2026-1794...

Google Is Suing Chinese Scammers Who Are Using Gemini

Not sure this will have any effect, but I support the effort: According to Google's legal filing, Outsider Enterprise operates through Telegram. The group offers phishing-as-a-service to individuals who may not be technically savvy enough to set up fraudulent websites and text campaigns on their...

django-oscar (>=1.1.0, <=1.1.1), django-oscar-telegram-bot (>=0.1.0, <=0.5.0) +2 more potentially affected by CVE-2026-54059 via pillow (2.7.0)

pillow PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-oscar =1.1.0, =0.1.0, =0.1.0, =0.1.1, =0.2.1 Source cves: CVE-2026-54059 Source advisory: OSV:PYSEC-2026-2253...

django-oscar (>=1.1.0, <=1.1.1), django-oscar-telegram-bot (>=0.1.0, <=0.5.0) +2 more potentially affected by CVE-2026-55798 via pillow (2.7.0)

pillow PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-oscar =1.1.0, =0.1.0, =0.1.0, =0.1.1, =0.2.1 Source cves: CVE-2026-55798 Source advisory: OSV:PYSEC-2026-2257...

django-oscar (>=1.1.0, <=1.1.1), django-oscar-telegram-bot (>=0.1.0, <=0.5.0) +2 more potentially affected by CVE-2026-54060 via pillow (2.7.0)

pillow PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-oscar =1.1.0, =0.1.0, =0.1.0, =0.1.1, =0.2.1 Source cves: CVE-2026-54060 Source advisory: OSV:PYSEC-2026-2254...

django-oscar (>=1.1.0, <=1.1.1), django-oscar-telegram-bot (>=0.1.0, <=0.5.0) +2 more potentially affected by CVE-2026-55379 via pillow (2.7.0)

pillow PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - django-oscar =1.1.0, =0.1.0, =0.1.0, =0.1.1, =0.2.1 Source cves: CVE-2026-55379 Source advisory: OSV:PYSEC-2026-2255...

CVE-2024-28996

creationtimestamp| type| source ---|---|--- 2026-07-06 12:00:06+00:00| seen| https://t.me/ZerodayAlert/249 2026-07-07 00:00:11+00:00| seen| https://t.me/ZerodayAlert/249 2026-07-11 23:00:04+00:00| seen| https://t.me/ZerodayAlert/249 2026-07-12 00:00:19+00:00| seen| https://t.me/ZerodayAlert/249...

CVE-2024-29004

creationtimestamp| type| source ---|---|--- 2026-07-06 11:00:06+00:00| seen| https://t.me/ZerodayAlert/249 2026-07-07 00:00:11+00:00| seen| https://t.me/ZerodayAlert/249 2026-07-11 23:00:04+00:00| seen| https://t.me/ZerodayAlert/249 2026-07-12 00:00:19+00:00| seen| https://t.me/ZerodayAlert/249...

Exploit for CVE-2026-25555

CVE-2026-2555...

Malicious Package

Overview @frostnode/probe is a malicious package. This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary. Impact The infostealer targets crypto wallets,...

Malicious Package

Overview @nullzero/urlcat is a malicious package. This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary. Impact The infostealer targets crypto wallets,...

Malicious Package

Overview @glitchpad/throttler is a malicious package. This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary. Impact The infostealer targets crypto...

Malicious Package

Overview @zynkit/jwtbytes is a malicious package. This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary. Impact The infostealer targets crypto wallets,...

Malicious Package

Overview @zynkit/probe is a malicious package. This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary. Impact The infostealer targets crypto wallets,...

Malicious Package

Overview @frostnode/waitfor is a malicious package. This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary. Impact The infostealer targets crypto wallets...

Malicious Package

Overview @thymelab/logfx is a malicious package. This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary. Impact The infostealer targets crypto wallets,...