Research

• npm:@fongsidev/scraper — Critical npm package '@fongsidev/scraper' leads to full system compromise (High)
• npm:@lordmega/baileys — Critical Malware Alert: npm package @lordmega/baileys Compromises Systems (High)
• CVE-2026-60004 — Gitea Code Injection: Repository Write Access Leads to Arbitrary Code Execution (Low)
• npm:mc-provider — Critical Malicious npm Package 'mc-provider' Poses Full System Compromise Risk (High)
• npm:statist-browser-typed-client-mb.product.analytics — CRITICAL: Malicious npm package 'statist-browser-typed-client-mb.product.analytics' compromises systems (High)
• CVE-2026-21962 — Oracle HTTP Server Proxy Plug-in: Critical Improper Access Control Vulnerability (KEV) (Critical)
• npm:security-node — Critical npm 'security-node' package compromise: immediate action required (High)
• npm:shopping-shared-atom-mobile-cart-counter — Critical npm Package 'shopping-shared-atom-mobile-cart-counter' Compromises Systems (High)
• npm:solidity-testing-utils — Malicious npm package 'solidity-testing-utils' (v1.2.0) facilitates credential theft (High)
• npm:fund-list-filter — Malicious npm Package 'fund-list-filter' Identified (High)
• npm:lumen-pages-community — Malicious npm package 'lumen-pages-community' exfiltrates system data on install (High)
• npm:@postman-cse/okta-aio-linux-arm64 — Critical Malware in npm Package @postman-cse/okta-aio-linux-arm64 (High)
• CVE-2026-73570 — Zimbra OS Command Injection: Unauthenticated RCE via Malicious SMTP Requests (High)
• pip:requests-crypt — Critical Malicious Package 'requests-crypt' in PyPI Contains Hidden Backdoor (High)
• npm:saas-f-testing — Critical npm Package 'saas-f-testing' Compromises Systems (High)
• CVE-2026-72529 — TrueConf Server: Critical Function Missing Authentication Allows Remote Script Execution (Moderate)
• CVE-2026-72530 — TrueConf Server Code Injection: Remote Code Execution via Port 4307/TCP (Moderate)
• npm:debug-fnt — Critical npm Package 'debug-fnt' Compromises Systems, Demands Immediate Action (High)
• npm:loadutils — Critical: Malicious 'loadutils' npm Package Compromises Systems (High)
• CVE-2026-64849 — MLflow SSRF: Internal Service Exposure via Server-Side Request Forgery (High)
• npm:gear-composer — Malicious npm package 'gear-composer' (v1.0.126) identified in credential theft campaign (High)
• npm:digital-interview-digital-interview-core — Critical Malware in npm Package 'digital-interview-digital-interview-core' (High)
• CVE-2026-55040 — Microsoft SharePoint Weak Auth Bypass: Critical Risk, In-the-Wild Exploitation (Critical)
• CVE-2026-59310 — VMware vCenter Path Traversal: Remote Code Execution Risk (High)
• CVE-2026-33824 — CISA KEV: Microsoft IKE Double Free Enables Remote Code Execution (Critical)
• npm:checkout-mobile-pay-button — Critical Malicious npm Package: 'checkout-mobile-pay-button' Compromises Systems (High)
• npm:@oyo_tech/oyochat_user — Malicious npm package @oyo_tech/oyochat_user identified in supply chain (High)
• CVE-2025-62593 — Ray-Project Ray Code Injection: Remote Code Execution via Firefox/Safari (Moderate)
• npm:sugarball-cli — Critical Malicious npm Package 'sugarball-cli' Poses Full System Compromise Risk (High)
• npm:arc-diag-util — Critical: Malicious 'arc-diag-util' npm Package Compromises Systems (High)
• npm:hunterone-build-probe-9210 — Critical npm package 'hunterone-build-probe-9210' steals credentials (High)
• npm:depcruise-wrap-stream-in-html — Critical Malicious npm Package: depcruise-wrap-stream-in-html (High)
• npm:kit-hydration-vim — Critical npm package 'kit-hydration-vim' leads to full system compromise (High)
• npm:svelte-goal-vim — Critical npm Package 'svelte-goal-vim' Compromises Systems (High)
• npm:amplitude-ma-ts — Critical npm package 'amplitude-ma-ts' identified as malware, leading to full compromise (High)
• npm:angular2-tesla-common — Critical Malicious npm Package 'angular2-tesla-common' Poses Full System Compromise Risk (High)
• npm:cc-skills-helper — Critical npm Package 'cc-skills-helper' Delivers Windows-Only Dropper (High)
• npm:nolimit-agent — Critical npm Package 'nolimit-agent' Compromises Systems (Critical)
• npm:@years18/n8n-nodes-utils-helper-t — Critical Malicious npm Package: @years18/n8n-nodes-utils-helper-t (High)
• npm:permit2 — Critical npm package 'permit2' identified as credential-stealing supply-chain threat (High)
• CVE-2026-72898 — Metabase SQLi: Unauthenticated Admin Access, Data Theft, and Configuration Tampering (High)
• CVE-2026-68820 — CVE-2026-68820: Windows AFD Use-After-Free Allows Local Privilege Escalation (Low)
• CVE-2026-20349 — Cisco Secure Firewall DoS Vulnerability Actively Exploited in the Wild (Low)
• npm:developer-dashboard — Critical npm Package 'developer-dashboard' Compromises Systems (High)
• npm:tilaver-mfa — Critical Supply Chain Alert: Malicious 'tilaver-mfa' npm Package Discovered (High)
• pip:pytablute — Critical Malicious Package 'pytablute' in PyPI Downloads Second-Stage Code (High)
• pip:chaintest — Critical Malicious PyPI Package 'chaintest' Steals Credentials and Crypto (High)
• npm:statist-browser-typed-client-eventea.projects.pwakasko — Critical npm Package 'statist-browser-typed-client-eventea.projects.pwakasko' Compromises Systems (High)
• pip:riakcs — Malicious pip package 'riakcs' (v0.0.1) exfiltrates host data on install (High)
• npm:sme-rko-finance-front-payments-domain — Critical Malicious npm Package: 'sme-rko-finance-front-payments-domain' Downloads Binaries (High)
• CVE-2026-8037 — Progress LoadMaster Command Injection: Critical Risk to Network Infrastructure (Critical)
• npm:gas-diff-core — Critical Malicious npm Package 'gas-diff-core' Targets Crypto Wallets (High)
• npm:postcss-theme-provider — Critical Malicious npm Package: 'postcss-theme-provider' Targets Crypto Wallets (High)
• npm:vitest-preview-pro-all — Critical Malicious npm Package: 'vitest-preview-pro-all' Enables Remote Code Execution (High)
• npm:tsihealth-client — Critical Malicious npm Package: 'tsihealth-client' Establishes Remote Control (High)
• CVE-2026-63077 — JetBrains TeamCity Deserialization RCE: Unauthenticated Threat via Agent Polling (High)
• npm:trapp-configuration — CRITICAL: Malicious 'trapp-configuration' npm Package Compromises Systems (High)
• npm:devplatform-vite-plugin-external — Critical Malicious npm Package 'devplatform-vite-plugin-external' Compromises Systems (High)
• CVE-2026-9198 — IBM Langflow Code Injection: Unauthenticated RCE in Default Deployments (Critical)
• CVE-2026-34486 — Apache Tomcat Encryption Bypass (CVE-2026-34486) Actively Exploited (Critical)
• CVE-2026-18556 — N-able N-central Authentication Bypass (CVE-2026-18556) Exploited In The Wild (Moderate)
• npm:@servicetitan/standalone-core-feature-gates — Critical npm package @servicetitan/standalone-core-feature-gates compromises systems (High)
• npm:@servicetitan/examples — Critical npm Package @servicetitan/examples Compromised (High)
• CVE-2026-18577 — N-able N-central Auth Bypass (CVE-2026-18577) Allows Account Takeover (Critical)
• npm:beaver-ui-header — Critical Malicious npm Package 'beaver-ui-header' Compromises Systems (High)
• npm:internallib_v568 — Critical npm Package 'internallib_v568' Compromises Systems (High)
• npm:pp-react-worldready — Malicious npm package 'pp-react-worldready' identified, communicates with malicious domain (High)
• pip:wacve-utils — Critical Malicious Package 'wacve-utils' in PyPI Targets Linux/Android Data (High)
• pip:nvtorch-oot-nightly — Malicious pip package 'nvtorch-oot-nightly' exfiltrates host information (High)
• pip:trtllm-subdir-test — Malicious PyPI Package 'trtllm-subdir-test' Exfiltrates Host Information (High)
• pip:cognikit — Critical Malicious 'cognikit' Package in PyPI Steals Credentials and Enables Remote Control (High)
• pip:walmart-genai-trace — Critical Malicious Package: 'walmart-genai-trace' in PyPI Exfiltrates Host Info (High)
• npm:js-client-node — Critical Malicious npm Package 'js-client-node' Compromises Systems (High)
• npm:@wbnr/design — Malicious npm package @wbnr/design identified, communicates with malicious domain (High)
• CVE-2026-20316 — Cisco Secure Firewall Management Center Hard-Coded Password Vulnerability (KEV) (High)
• npm:poly-kelly — Critical npm Package 'poly-kelly' Compromises Systems for Credential Theft (High)
• npm:polymarket-risk-manager — Critical Malicious npm Package 'polymarket-risk-manager' Compromises Systems (High)
• npm:lib-mtop — CRITICAL: Malicious npm package 'lib-mtop' leads to full system compromise (High)
• npm:local-config-parser — Critical npm package 'local-config-parser' identified as malware (High)
• CVE-2026-16812 — Arista VeloCloud Orchestrator OS Command Injection: Critical Risk to Orchestrator Hosts (High)
• npm:pp-react-ui5 — Critical Malware Alert: npm package 'pp-react-ui5' leads to full system compromise (High)
• npm:payoutsvettingserv-paypal — Critical npm Package 'payoutsvettingserv-paypal' Compromises Systems (High)
• CVE-2025-68686 — Fortinet FortiOS: Post-Exploitation Information Exposure in KEV (Moderate)
• npm:@antv/g-plugin-dom-interaction — Critical npm Package Compromise: @antv/g-plugin-dom-interaction Steals Credentials (High)
• npm:@antv/g-plugin-svg-picker — Critical Malicious npm Package: @antv/g-plugin-svg-picker Steals Credentials (High)
• npm:-john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love — Critical Malicious npm Package: '-john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love' (High)
• npm:-whareo-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-home — Malicious npm package '-whareo-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-home' identified (High)
• npm:app-data-ist — Critical: Malicious 'app-data-ist' npm Package Compromises Systems (High)
• npm:app-node-layer — Critical npm package 'app-node-layer' leads to full system compromise (High)
• CVE-2026-50522 — Microsoft SharePoint Deserialization Vulnerability Actively Exploited (KEV) (Critical)
• npm:svelte-streak-metrics — Critical: Malicious 'svelte-streak-metrics' npm Package Compromises Systems (High)
• npm:streak-lib-math — Critical npm Package 'streak-lib-math' Compromises Systems (High)
• CVE-2026-16232 — Check Point SmartConsole Improper Authentication Allows Full Admin Access (High)
• npm:veldora — Critical npm Package 'veldora' Compromises Systems, Demands Immediate Action (High)
• npm:kijai — Critical: Malicious 'kijai' npm Package Compromises Systems (High)
• CVE-2026-63030 — WordPress Core SQLi/RCE: Critical Vulnerability Exploited in the Wild (Critical)
• pip:ztasimb — Critical Malicious Package 'ztasimb' Identified in PyPI Ecosystem (High)
• pip:zmaker — Malicious 'zmaker' (PyPI) Package Part of Telegram Data Exfiltration Campaign (High)
• CVE-2026-0770 — Langflow RCE: Critical Vulnerability Actively Exploited in the Wild (Critical)
• CVE-2026-60137 — WordPress Core SQLi: Chained RCE for Unauthenticated Attackers (Critical)
• npm:lambda-cloudwatch-cdk — Critical Malware in npm Package 'lambda-cloudwatch-cdk' Poses Full Compromise Risk (High)
• npm:iot-kfh-s3 — Critical npm package 'iot-kfh-s3' compromises host systems (High)
• rust:semantic-search-client — Malicious Rust Package 'semantic-search-client' Identified in crates.io (High)
• rust:supertag — Malicious Rust Package 'supertag' (v99.1.1) Identified (High)
• rust:replit_ruspty — Malicious Rust Package 'replit_ruspty' Identified in crates.io (High)
• rust:proton-pfff — Malicious Rust Package 'proton-pfff' Identified in crates.io (High)
• CVE-2026-39808 — FortiSandbox OS Command Injection: Unauthenticated RCE, Actively Exploited (Critical)
• npm:scan-only — Critical Malicious 'scan-only' npm Package Compromises Systems (High)
• npm:anthropic-claude-latest — Critical npm Package 'anthropic-claude-latest' Compromises Systems (High)
• CVE-2026-25089 — FortiSandbox OS Command Injection: Unauthenticated RCE, Actively Exploited (Critical)
• CVE-2026-58644 — Microsoft SharePoint Deserialization Flaw: Remote Code Execution Risk (High)
• npm:ai-p2p — Critical npm Package 'ai-p2p' Compromises Systems, Steals Credentials (High)
• npm:loader1 — CRITICAL: Malicious npm package 'loader1' compromises systems (High)
• npm:datefmt-helper — CRITICAL: Malicious 'datefmt-helper' npm package compromises systems (High)
• pip:fflask — Critical Typosquatting: Malicious 'fflask' Package in PyPI Ecosystem (High)
• CVE-2026-56155 — Microsoft ADFS Privilege Escalation (CVE-2026-56155) Actively Exploited (Moderate)
• CVE-2023-4346 — KNX Protocol Lockout Mechanism Allows Device Purge and Lockout (Moderate)
• CVE-2026-46817 — Oracle E-Business Suite Payments Vulnerability: Unauthenticated Takeover Risk (High)
• npm:monitoring-service-util — Critical: Malicious 'monitoring-service-util' npm package compromises systems (High)
• npm:node-fsagent — Critical npm package 'node-fsagent' compromises systems, enabling credential theft (Critical)
• npm:react-dynammic-table-component — Critical npm Package 'react-dynammic-table-component' Leads to Full Compromise (High)
• npm:babel-preset-lib-client — Critical npm package 'babel-preset-lib-client' compromises systems (High)
• CVE-2008-4128 — Cisco IOS Cross-Site Forgery: Remote Command Execution Risk (Critical)
• npm:type-atob — CRITICAL: Malicious 'type-atob' npm package compromises systems (High)
• npm:type-elint — Critical npm package 'type-elint' compromises systems via supply chain attack (High)
• npm:auth-next-gen — Critical npm Package 'auth-next-gen' Compromises Systems (High)
• npm:authvaultx — CRITICAL: Malicious 'authvaultx' npm Package Compromises Systems (High)
• npm:babel-eslint-parser-legacy — Critical Malware Alert: npm's babel-eslint-parser-legacy Compromises Systems (High)
• npm:@higherlogic/ocfe — CRITICAL: Malicious npm package '@higherlogic/ocfe' leads to full system compromise (High)
• CVE-2026-48939 — iCagenda Unrestricted File Upload: Critical for Web Servers Handling User Content (High)
• CVE-2026-56291 — Balbooa Forms Unrestricted File Upload Leads to Remote Code Execution (Moderate)
• npm:promo-helper — Critical npm package 'promo-helper' leads to full system compromise (High)
• npm:common-tg-service — Critical npm Package 'common-tg-service' Compromises Systems (Critical)
• npm:whs4_npm_test — Critical npm Package 'whs4_npm_test' Compromises Systems (High)
• CVE-2026-56290 — Joomlack Page Builder RCE via Unauthenticated Arbitrary File Upload (KEV) (Moderate)
• CVE-2026-55255 — Langflow Auth Bypass: Authenticated Attackers Can Execute Other Users' Flows (Moderate)
• CVE-2026-48908 — JoomShaper SP Page Builder: Unrestricted File Upload Leads to Remote Code Execution (High)
• npm:xnder-sdk-js — Critical npm package 'xnder-sdk-js' compromises systems via supply-chain attack (High)
• npm:@jaime9008/math-service — Critical Malware in npm Package @jaime9008/math-service (High)
• npm:@node-cloud/create — Critical npm package '@node-cloud/create' identified as malware (High)
• npm:@sql-trigger/nodesql — CRITICAL: Malicious npm package @sql-trigger/nodesql leads to full system compromise (High)
• npm:alder_morrgan — CRITICAL: Malicious npm package 'alder_morrgan' compromises systems (High)
• npm:api-node-utils — Critical Malicious npm Package 'api-node-utils' Compromises Systems (High)
• npm:web-api-node — Critical npm package 'web-api-node' identified as malware, leading to full compromise (High)
• npm:typescript-util-core — Critical Supply-Chain Alert: Malicious 'typescript-util-core' npm Package (High)
• npm:db-convertor — Critical Malicious npm Package 'db-convertor' Poses Full System Compromise Risk (High)
• npm:animatecss-postcss-plugin — Critical npm Package 'animatecss-postcss-plugin' Compromises Systems (High)
• npm:rebrandly-domains-search-client — Critical Malware Alert: npm package 'rebrandly-domains-search-client' Compromises Systems (High)
• npm:chai-as-persisted — Critical npm Package 'chai-as-persisted' Compromises Host Systems (High)
• CVE-2026-45659 — Microsoft SharePoint Server Deserialization Vulnerability Exploited In The Wild (Critical)
• npm:endpointmap — CRITICAL: Malicious 'endpointmap' npm package compromises host systems (High)
• npm:procwire — Critical Malicious npm Package 'procwire' Poses Full System Compromise Risk (High)
• npm:autotel-backends — Critical npm package 'autotel-backends' v2.12.26 compromises host systems (High)
• npm:autotel-cli — Critical npm package 'autotel-cli' v0.8.14 compromises host systems (High)
• CVE-2026-20230 — Cisco Unified CM SSRF: Critical RCE Risk, Actively Exploited in the Wild (Critical)
• CVE-2026-12569 — PTC Windchill/FlexPLM: Unauthenticated RCE via Input Validation Flaw (KEV) (High)
• CVE-2026-48558 — SimpleHelp OIDC Auth Bypass: Forged Tokens Grant Full Technician Access (High)
• npm:velocityfix — Critical: Malicious 'velocityfix' npm package compromises systems (Critical)
• npm:hunsterx-package — Critical Supply-Chain Alert: Malicious 'hunsterx-package' in npm Ecosystem (High)
• CVE-2024-3094 — Critical XZ Utils Backdoor: Pre-Auth RCE in Internet-Facing Systems (Critical)