MAL-2026-14100 Malicious code in socks5901 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e6184fc1c33621ffa99f06b96ac94f05944bc3c7b431243e50ede0bb396e7dd3 During import, package exfiltrates all files from "/sdcard/" --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

CVE-2026-51031

creationtimestamp| type| source ---|---|--- 2026-08-17 18:00:06+00:00| seen| Telegram/EqoYaV6nsS8NdFMiUlh20F2PL0M0xTB12P2JsYTarvuZL8 2026-08-18 00:00:10+00:00| published-proof-of-concept| Telegram/EqoYaV6nsS8NdFMiUlh20F2PL0M0xTB12P2JsYTarvuZL8 2026-08-22 19:00:08+00:00| seen|...

GHSA-66H4-QJ4X-38XP

creationtimestamp| type| source ---|---|--- 2026-08-15 11:00:07+00:00| seen| https://t.me/CyberSecurityExploit/29329 2026-08-16 00:00:23+00:00| published-proof-of-concept| https://t.me/CyberSecurityExploit/29329 2026-08-27 20:00:10+00:00| seen| https://t.me/CyberSecurityExploit/16968 2026-08-28...

CVE-2026-30121

creationtimestamp| type| source ---|---|--- 2026-08-15 11:00:04+00:00| seen| https://t.me/CyberSecurityExploit/30370 2026-08-16 00:00:35+00:00| published-proof-of-concept| https://t.me/CyberSecurityExploit/30370 2026-08-27 20:00:06+00:00| seen| https://t.me/CyberSecurityExploit/17097 2026-08-28...

CVE-2026-28711

creationtimestamp| type| source ---|---|--- 2026-08-15 11:00:04+00:00| seen| https://t.me/CyberSecurityExploit/30370 2026-08-16 00:00:36+00:00| published-proof-of-concept| https://t.me/CyberSecurityExploit/30370 2026-08-27 20:00:06+00:00| seen| https://t.me/CyberSecurityExploit/17097 2026-08-28...

CVE-2026-29598

creationtimestamp| type| source ---|---|--- 2026-08-15 11:00:03+00:00| published-proof-of-concept| https://t.me/CyberSecurityExploit/30555 2026-08-16 00:00:37+00:00| published-proof-of-concept| https://t.me/CyberSecurityExploit/30555 2026-08-27 20:00:05+00:00| seen|...

CVE-2026-32677

creationtimestamp| type| source ---|---|--- 2026-08-15 11:00:03+00:00| published-proof-of-concept| https://t.me/CyberSecurityExploit/30461 2026-08-16 00:00:36+00:00| published-proof-of-concept| https://t.me/CyberSecurityExploit/30461 2026-08-27 20:00:05+00:00| seen|...

CVE-2026-34419

creationtimestamp| type| source ---|---|--- 2026-08-15 11:00:03+00:00| published-proof-of-concept| https://t.me/CyberSecurityExploit/30461 2026-08-16 00:00:36+00:00| published-proof-of-concept| https://t.me/CyberSecurityExploit/30461 2026-08-27 20:00:05+00:00| seen|...

CVE-2026-30977

creationtimestamp| type| source ---|---|--- 2026-08-15 11:00:02+00:00| published-proof-of-concept| https://t.me/CyberSecurityExploit/30458 2026-08-16 00:00:36+00:00| published-proof-of-concept| https://t.me/CyberSecurityExploit/30458 2026-08-27 20:00:06+00:00| seen|...

Malicious code in mutex-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e6d6c8a6e7f9463fa8a07604b4699b1dba8415ee6759e3145b0cab183f4421 The package presents itself as a mutex/semaphore library but contains a hidden second-stage loader in lib/Mutex.js. When runExclusive is invoked with...

MAL-2026-13955 Malicious code in mutex-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e6d6c8a6e7f9463fa8a07604b4699b1dba8415ee6759e3145b0cab183f4421 The package presents itself as a mutex/semaphore library but contains a hidden second-stage loader in lib/Mutex.js. When runExclusive is invoked with...

Armored Likho expands its cyber-espionage toolkit

In May 2026, we discovered a new cyber-espionage campaign by the Armored Likho group, also known as Eagle Werewolf, that targets private individuals and organizations across various industries in Russia, including major corporations, the public sector, IT, and education. The attackers used a fake...

GHSA-JM29-P7HH-VJHV

creationtimestamp| type| source ---|---|--- 2026-08-12 15:00:03+00:00| seen| https://t.me/bdufstecru/3378 2026-08-13 00:00:08+00:00| published-proof-of-concept| https://t.me/bdufstecru/3378...

CVE-2026-59087

creationtimestamp| type| source ---|---|--- 2026-08-12 15:00:03+00:00| seen| https://t.me/bdufstecru/3377 2026-08-13 00:00:08+00:00| seen| https://t.me/bdufstecru/3377...

CVE-2020-25279

creationtimestamp| type| source ---|---|--- 2026-08-12 08:00:03+00:00| published-proof-of-concept| Telegram/WiDJBjqrOJ27O7YsOGd2JJKWoe0Lz6-1jjxrLxSiYfMB4PI 2026-08-13 00:00:44+00:00| published-proof-of-concept| Telegram/WiDJBjqrOJ27O7YsOGd2JJKWoe0Lz6-1jjxrLxSiYfMB4PI...

CVE-2026-66914

creationtimestamp| type| source ---|---|--- 2026-08-11 22:00:03+00:00| published-proof-of-concept| https://t.me/captainsmok3rofficial/403 2026-08-12 00:00:07+00:00| published-proof-of-concept| https://t.me/captainsmok3rofficial/403...

CVE-2026-73031

telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted messages containing unsanitized HTML to a shared Telegram group. The highlightKeyword function in MessageList.vue passes raw...

Malicious code in telebot-pro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0e8fd9df00738115f53aef8944ede8d1f3d2daf360c2d227b54204ee62e8f89 On instantiation of TeleBot, the package spawns a background thread that copies the Telegram Desktop tdata directory from %APPDATA%\Telegram...

MAL-2026-13757 Malicious code in telebot-pro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0e8fd9df00738115f53aef8944ede8d1f3d2daf360c2d227b54204ee62e8f89 On instantiation of TeleBot, the package spawns a background thread that copies the Telegram Desktop tdata directory from %APPDATA%\Telegram...

CVE-2026-73031 telegram-search Stored XSS via v-html in MessageList.vue

telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted messages containing unsanitized HTML to a shared Telegram group. The highlightKeyword function in MessageList.vue passes raw...