CVE-2026-64805

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling...

CVE-2026-64805

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling...

EUVD-2026-48229

In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling...

PT-2026-63962

Name of the Vulnerable Software and Affected Versions JetBrains PhpStorm versions prior to 2026.2 Description Arbitrary code execution is possible through project tooling before the user grants trust to the project. Recommendations Update JetBrains PhpStorm to version 2026.2...

PT-2026-63959

Name of the Vulnerable Software and Affected Versions JetBrains WebStorm versions prior to 2026.2 Description Arbitrary code execution is possible through project-local package-manager tooling before the user grants trust to the project. Recommendations Update JetBrains WebStorm to version 2026.2...

PT-2026-63958

Name of the Vulnerable Software and Affected Versions JetBrains WebStorm versions prior to 2026.2 Description Arbitrary code execution is possible through project-local linter tooling before the user grants trust to the project. Recommendations Update JetBrains WebStorm to version 2026.2...

MAL-2026-11007 Malicious code in web3-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bff469765665422f3b9a6dd9978d99ddab9f853b02109f154c97b634977cf223 On npm install, package.json scripts.postinstall runs test.js, which invokes routines in index.js that 1 walk the current working directory for id.js...

Malicious code in @wagni_bot/eth-agent (npm)

The npm package @wagnibot/eth-agent is a supply-chain credential stealer disguised as a Ethereum SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

Virtuozzo Infrastructure 7.4 (7.4.0-66)

This release updates managed Kubernetes to version 1.35.3 and Fedora CoreOS to version 43, introduces API credentials for external automation workflows, and provides the updater patches and tooling required to upgrade the product to version 8.0. It also includes object storage performance...

CVE-2026-59822

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key...

VulnCheck KEV: CVE-2026-59822

BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token...

SUSE-SU-2026:22572-1 Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues: Update to go1.26.4 bsc1255111. Security issues fixed: - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG bsc1261653. - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination bsc1261654. -...

DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts

A Microsoft 365 device code phishing campaign has been observed leveraging collaboration-themed lures to take control of victim accounts between the last week of June 2026 and into early July, per findings from ZeroBEC. "The campaign did not depend on a fake Microsoft password page. It used a...

MAL-2026-7311 Malicious code in launchdarkly-ai-tooling (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in launchdarkly-ai-tooling (npm)

--- -= Per source details. Do not edit below this line.=-...

VDT

Vulnerability Discovery Training VDT Training data for adva...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: splunk-otel-collector, policy-controller, minio, opentelemetry-collector, wal-g, crossplane-provider-azure-sql, melange, step, vault-benchmark, gh, rancher-agent, scorecard, k3s, kubernetes-dashboard, dagger, fulcio, crossplane-provider-family-azure, k8sgpt,...

CVE-2025-71339

Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.evallength gadget in pickle reduce methods, allowing arbitrary code execution. Attackers can craft malicious pickle files that execute arbitrary Python code when loaded by victims who trust Picklescan's safety validation...

CVE-2026-53655

node-tar is a full-featured Tar for Node.js. Prior to 7.5.16, tar node-tar applies a PAX extended header's size= record and other PAX overrides to the next header entry of any type, including intermediary metadata headers such as a GNU long-name L or long-link K entry. Per POSIX pax, a PAX extend...