467 matches found
Malicious code in vs-supplier-portal-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd4ce50d0cee946b14aa2dee0c469a73331ff0c63bc65b134b3b50edb5d43c54 The package vs-supplier-portal-web was found to contain malicious code. Source: ghsa-malware...
MAL-2026-2693 Malicious code in vs-supplier-portal-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd4ce50d0cee946b14aa2dee0c469a73331ff0c63bc65b134b3b50edb5d43c54 The package vs-supplier-portal-web was found to contain malicious code. Source: ghsa-malware...
CVE-2026-34060: Improper Control of Generation of Code
Ruby LSP is an implementation of the language server protocol for Ruby. Prior to Shopify.ruby-lsp version 0.10.2 and ruby-lsp version 0.26.9, the rubyLsp.branch VS Code workspace setting was interpolated without sanitization into a generated Gemfile, allowing arbitrary Ruby code execution when a...
Uncovering Relationships between Android Developers, User Privacy, and Developer Willingness to Reduce Fingerprinting Risks
The major mobile platforms, Android and iOS, have introduced changes that restrict user tracking to improve user privacy, yet apps continue to covertly track users via device fingerprinting. We study the opportunity to improve this dynamic with a case study on mobile fingerprinting that evaluates...
CVE-2026-32732: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Lean 4 VS Code Extension is a Visual Studio Code extension for the Lean 4 proof assistant. Projects that use @leanprover/unicode-input-component are vulnerable to an XSS exploit in 0.1.9 of the package and lower. The component re-inserted text in the input element back into the input element as...
vsFTPd-2.3.4-exploit-netcat-revshell-PoC
vsFTPd...
CVE-2026-25960 SSRF Protection Bypass in vLLM
vLLM is an inference and serving engine for large language models LLMs. The SSRF protection fix for CVE-2026-24779 add in 0.15.1 can be bypassed in the loadfromurlasync method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client. The SSRF fix uses...
Cline CLI 2.3.0 Supply Chain Attack Installed OpenClaw on Developer Systems
In yet another software supply chain attack, the open-source, artificial intelligence AI-powered coding assistant Cline CLI was updated to stealthily install OpenClaw, a self-hosted autonomous AI agent that has become exceedingly popular in the past few months. "On February 17, 2026, at 3:26 AM P...
CVE-2026-26267 rs-soroban-sdk #[contractimpl] macro calls inherent function instead of trait function when names collide
soroban-sdk is a Rust SDK for Soroban contracts. Prior to versions 22.0.10, 23.5.2, and 25.1.1, the contractimpl macro contains a bug in how it wires up function calls. contractimpl generates code that uses MyContract::value style calls even when it's processing the trait version. This means if a...
CVE-2019-16765
If an attacker can get a user to open a specially prepared directory tree as a workspace in Visual Studio Code with the CodeQL extension active, arbitrary code of the attacker's choosing may be executed on the user's behalf. This is fixed in version 1.0.1 of the extension. Users should upgrade to...
VS Code Forks Recommend Missing Extensions, Creating Supply Chain Risk in Open VSX
Popular artificial intelligence AI-powered Microsoft Visual Studio Code VS Code forks such as Cursor, Windsurf, Google Antigravity, and Trae have been found to recommend extensions that are non-existent in the Open VSX registry, potentially opening the door to supply chain risks when bad actors...
The vulnerability of the VS6Sim.exe software, which is used for configuring HMI interfaces of Monitouch V-SFT and monitoring systems for TELLUS PLCs, allows a attacker to execute arbitrary code.
The vulnerability of the VS6Sim.exe program, which is used for configuring Monitouch V-SFT HMI interfaces and monitoring systems for TELLUS PLCs, lies in the escape of the operation beyond the buffer in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending...
PT-2025-50977
Name of the Vulnerable Software and Affected Versions Lightning Flow Scanner versions 6.10.5 and below Description Lightning Flow Scanner, a CLI plugin, VS Code Extension, and GitHub Action for Salesforce Flow analysis and optimization, is affected by an issue where maliciously crafted flow...
Malicious code in thambi-rasdfa-vs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fa43b4c6a2653ab2af27d8ea855c30e2f06f41277f915ecfa5538da507e5136 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in thambi-vers-vs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 927ee9a00201c5a6763c0ba818a743bca38d4d7a529c141e0fc19190913274d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in thumbi-vs-trsud (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b733b2bcd227667474e49b3c7195c9c2a76ea6875b4e60b665212f2bb9bbc21 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in thumbi-vs-trud (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ab027cf060ac98adddd8456064cd11199dd4fa65b1792a1c6df1af0d553a96d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in thumbi-vs-yunit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 932bc33c6478912fbedd1e7db522bcd4d2fee122a9ba408d810194baa4563094 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in thumbi-vs-yunita (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57ddcfb23a5d1d7b536eef4c3fd361e7cd48618ae5bac94c038e43e9dcc5250f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
