Malware in dsh-notify-focus

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in reqnests (PyPI)

Source: kam193 285a91689676a0169502a364e60033283150056487ad681648ab60cb4fe6d23e During import, package exfiltrates sensitive Telegram files to a remote location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-11-reqnest Reasons based on the...

Malicious code in reqnest (PyPI)

Source: kam193 819e0998a4223acf5f70c15fbbeea8f9c9bf801044d5974622ebc2a971bc2c61 During import, package exfiltrates sensitive Telegram files to a remote location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-11-reqnest Reasons based on the...

Malicious code in ajfhiuqhfqgwerhuqnfqh (PyPI)

Source: kam193 e1da9c2dae077cc96d13ab9964ca2887742f0dc1bc2a3e92f4b0bf9b6d0e3b04 During import, package exfiltrates sensitive Telegram files to a remote location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-11-reqnest Reasons based on the...

Malicious code in fhqiouhq (PyPI)

Source: kam193 50625c43075a763e4420504dcbcc8b14236874f2924ec20eabcf5d7b45b0a274 During import, package exfiltrates sensitive Telegram files to a remote location. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-11-reqnest Reasons based on the...

Malware in @cherrydotfun/miniapp-sdk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in hello-bat-fwi9 (PyPI)

Source: kam193 915b488501776e1dc1f9c551e0a52310fc6daa8a299b0638f6d5d7f615d1ad8b The package delivers an obfuscated .bat file delivering a RAT, with the help of its own Python runtime and PTH files. The code requires manually triggering the malicious action. This is most likely a continuation of t...

Malware in tailwind-animationfound

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in modelsdesk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in kampodine

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in automic-style-engine

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

LXD has restricted project bypass leading to arbitrary command execution

Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Summary Instance snapshots ignore the restricted.containers.lowlevel=block setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as raw.lxc and raw.qemu. Details...

LXD has project restriction bypass for custom volume copy across projects

Reported from https://github.com/lxc/incus/security/advisories/GHSA-64f3-v33m-w89f Summary Missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custo...

LXD has project restriction bypass in instance copy across projects

Reported from https://github.com/lxc/incus/security/advisories/GHSA-c9f5-j9c3-mhrg Summary Missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a...

GeoNode has Stored XSS in Documents metadata abstract field

The abstract metadata of documents is not sanitised. It’s possible to store arbitrary HTML and JS that will be executed when visiting the page...

GeoNode has Unrestricted File Upload

The upload service validation can be circumvented with specially crafted requests, allowing for the storage and serving of malicious files...

GeoNode has OS command injection via uploaded file layer name

Arbitrary OS commands can be executed on the GeoNode by uploading a vector file with a crafted layer name...

LXD has CreateCustomVolumeFromBackup nil-pointer dereference on volumes[0].snapshots[*].expires_at

Summary sibling-field variant of CVE-2026-40197 fix 05bc272 lxdBackend.CreateCustomVolumeFromBackup in lxd/storage/backendlxd.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with...

LXD has arbitrary file write on client due to trusted image hash

Reported from https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x Summary An arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the server. Details -...

LXD has argument injection in backup compression algorithm leading to AFW and ACE

Reported from https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4 Summary Improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrar...

LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image

Reported from https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details Incus validates an image as soon as it sees a normal...

LXD has arbitrary file read+write on host via templates/ symlink in malicious image

Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479 Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details For container images, internal/server/storage/utils.go cal...

LXD has arbitrary file write on host via `exec-output` symlink in crafted image

Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Summary The record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named execUUID.stdout and...

LXD: SSRF via image import from URL allows internal network probing by authenticated users

Summary The LXD image import-from-URL endpoint POST /1.0/images with source.type=url makes server-side HTTP requests to an attacker-supplied URL without any private-IP or loopback blocking. An authenticated user with the cancreateimages entitlement can force the LXD daemon to connect to internal...

listmonk: SQL Injection in `/api/subscribers/export` bypasses table access control, leaking admin password hashes and SMTP credentials

Summary A SQL injection vulnerability in GET /api/subscribers/export allows an authenticated user with the subscribers:sqlquery permission to bypass the table access control that exists on the regular query endpoint GET /api/subscribers and read arbitrary tables from the database — including user...

OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy

Impact The console-proxy's RemoteConfigResolver parses kubeconfig data from Kubernetes Secrets using clientcmd.RESTConfigFromKubeConfig without sanitizing the resulting rest.Config. A kubeconfig containing an exec plugin stanza under users.user.exec is faithfully preserved. When rest.TransportFor...

Eclipse hawkBit DDI has Privilege Escalation that allows Tenant-Isolated Firmware Exfiltration

Description A privilege escalation vulnerability has been identified in the Direct Device Integration DDI Controller of Eclipse hawkBit versions 1.0.3 and prior. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned updates...

Malware in monobomber

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in monopw

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in tw-motion-css

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in wisdomtreetest

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @sideeffects/n

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @noinheritdoc/n

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @site-cms/ssr

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @ts-expect-error/n

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @needsaudit/nexport

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @needsaudit/n

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @smart-dev-wa/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in zero2-baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in arc-contracts

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in evmos-contracts

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in kc-kline-chart

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in ccb-app-ui-service

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in securedrop-app

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in sickle-wrapper

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in vfat-tools

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @kora20030101/test-pkg-delete-me

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @exclipz/bails

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @exclipz/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @nuri.yavuz.tr.2/my-unique-pinger (npm)

Source: ossf-package-analysis d9a584d7d9890fd25a656e38f323071b7ac3b419a2050fe50452c598f78a4876 The OpenSSF Package Analysis project identified '@nuri.yavuz.tr.2/my-unique-pinger' @ 1.0.2 npm as malicious. It is considered malicious because: - The package executes one or more commands associated...