Research

• pip:proxy-rubikis — CRITICAL: Malicious 'proxy-rubikis' (PyPI) package exfiltrates files (High)
• pip:getpubip — Critical Malicious Package 'getpubip' in PyPI Ecosystem Steals Credentials (High)
• CVE-2026-76519 — Cisco Secure Email Gateway Path Traversal: Critical for Email Infrastructure Defense (High)
• CVE-2026-105134 — AhsayCBS Command Injection: Critical Vulnerability Actively Exploited in the Wild (Critical)
• CVE-2026-21589 — Atlassian Data Center Vulnerability: Unauthenticated File Access in KEV (Critical)
• npm:monkey-tags-ip — Critical npm Package 'monkey-tags-ip' Implicated in Dependency Confusion Attack (High)
• npm:@xxxfnbs21/hello-demo — Critical Malware Alert: npm package @xxxfnbs21/hello-demo compromises systems (High)
• npm:opencode2-windows-x64 — Critical Malware Alert: 'opencode2-windows-x64' npm Package Compromises Systems (Critical)
• CVE-2026-96951 — CISA KEV: Windows Shell Command Injection Allows Network Security Bypass (Low)
• CVE-2026-104935 — Ivanti Connect Secure Auth Bypass: Remote Unauthenticated Command Execution (Low)
• npm:@coopeuch/config — CRITICAL: Malicious npm package @coopeuch/config compromises host systems (High)
• pip:npp-ml — Malicious pip package 'npp-ml' impersonates Notepad++, delivers ADExplorer (High)
• rubygems:staking-apr-fetcher — Malicious RubyGem 'staking-apr-fetcher' Delivers Interactive Shell Backdoor (High)
• rubygems:xrp-ledger-utils — Malicious RubyGem 'xrp-ledger-utils' Delivers Remote Shell via Install-Time Dropper (High)
• pip:pafer — Critical Malicious 'pafer' Package in PyPI Establishes Persistence and Remote Access (High)
• pip:agent-vx — Critical Malicious PyPI Package 'agent-vx' Poses Remote Code Execution Risk (High)
• npm:@tunstock/remact-dom — Critical Typosquatting: Malicious @tunstock/remact-dom npm Package Exfiltrates Data (High)
• npm:kmf-vendor-pack — Malicious npm package 'kmf-vendor-pack' (v99.0.0) leaks host data on install (High)
• npm:@dransay/logger — Malicious npm package @dransay/logger performs reconnaissance via dependency confusion (High)
• npm:@dransay/feature-flags — Malicious npm Package `@dransay/feature-flags` Leaks IP During Install (High)
• CVE-2023-22894 — Strapi Cleartext Storage Vulnerability: Sensitive Data Exposure via Admin Panel (High)
• CVE-2016-3081 — Apache Struts Command Injection: Critical Threat with Active Exploitation (Critical)
• CVE-2015-5477 — ISC BIND TKEY Vulnerability: Critical DoS Risk, Exploited in the Wild (Critical)
• npm:@ikyyjee/ikkysingle — Critical Malware in npm Package @ikyyjee/ikkysingle Poses Full System Compromise Risk (High)
• npm:tailwindcss-animatecss-keyframes — Critical Malware in npm Package 'tailwindcss-animatecss-keyframes' (High)
• npm:captchetat-angularv8 — Critical npm Package 'captchetat-angularv8' Compromises Systems (High)
• npm:@kxa/xbails — CRITICAL: Malicious npm package @kxa/xbails leads to full system compromise (High)
• CVE-2026-88779 — Citrix NetScaler DoS vulnerability actively exploited in the wild (KEV) (High)
• rubygems:web3-sign-helper — Critical RubyGems Package 'web3-sign-helper' Identified as Malicious Dropper (High)
• npm:@inpeek/odata-angular — Critical Malware in npm Package @inpeek/odata-angular (High)
• pip:infrabench — Malicious 'infrabench' (pip) Package Deploys Coin Miner (High)
• pip:caoxiltts — Malicious pip package 'caoxiltts' deploys coin miner (High)
• pip:voxcpmintel — CRITICAL: Malicious 'voxcpmintel' PyPI Package Deploys Coin Miner (High)
• pip:voxcpmui4 — Malicious pip Package 'voxcpmui4' Deploys Coin Miner (High)
• go:gogets.dev/btreex — Malicious Go Package `gogets.dev/btreex` Steals Credentials (High)
• pip:dedh-devops-automation — Critical Malicious pip Package: dedh-devops-automation Steals Credentials (High)
• CVE-2026-104286 — FortiMail Path Traversal: Unauthenticated File Write via Crafted HTTP/S Requests (High)
• CVE-2026-102489 — Zammad Session Fixation Leads to RCE (CVE-2026-102489) (High)
• CVE-2026-102490 — Zammad Privilege Escalation: Local User to Root, Chained with Other Vulnerabilities (Moderate)
• npm:online-header — Critical Malicious Package 'online-header' Identified in npm Ecosystem (High)
• pip:friendly-tools — Critical: Malicious 'friendly-tools' pip package exfiltrates Snowflake credentials (High)
• npm:com.epi.e2e_test — Critical Malicious npm Package 'com.epi.e2e_test' Gathers Host Data (High)
• npm:ddok-modal — Critical npm Package 'ddok-modal' Compromises Systems (High)
• CVE-2026-76504 — Cisco SD-WAN Manager Hex Encoding Flaw Allows Unauthenticated Admin Access (Low)
• npm:txs-lib-sdk — Critical npm package 'txs-lib-sdk' compromises systems, demands immediate action (High)
• npm:@hrmony/kit-4 — Critical Malicious npm Package '@hrmony/kit-4' Steals Credentials (High)
• CVE-2026-86950 — Apple CoreGraphics Out-of-Bounds Write: Arbitrary Code Execution in KEV (High)
• npm:simple-date-formatter-new-12 — Malicious npm package 'simple-date-formatter-new-12' conducts SSRF and data exfiltration (High)
• npm:nebulaai-sdk — Critical Malicious npm Package 'nebulaai-sdk' Delivers Windows Executable (High)
• CVE-2026-88771 — Citrix NetScaler Improper Input Validation: Unauthenticated RCE, CISA KEV Listed (Low)
• CVE-2026-88772 — Citrix NetScaler Memory Buffer Vulnerability: Remote Code Execution Risk (Low)
• pip:scrapetools2 — Critical Malicious Package: 'scrapetools2' (pip) Executes Arbitrary Remote Code (High)
• pip:aseity — Critical: Malicious 'aseity' package in PyPI performs credential theft (High)
• npm:chai-as-relay — Critical Malicious Package 'chai-as-relay' in npm Poses Supply-Chain Risk (High)
• npm:cma-self-hosted-sandbox-cf — Critical Malicious npm Package 'cma-self-hosted-sandbox-cf' Exfiltrates System Data (High)
• CVE-2026-87902 — WordPress Core RFI: Unauthenticated RCE via Template Inclusion (KEV) (Critical)
• pip:tego-managed-agents-test — Critical: Malicious 'tego-managed-agents-test' (PyPI) Exfiltrates Environment Variables (High)
• npm:@airbnb-extended/typescript-config — Malicious npm package @airbnb-extended/typescript-config poses supply-chain risk (High)
• CVE-2026-5430 — WSO2 Path Traversal: Unrestricted File Upload Leads to RCE, Exploited in Wild (High)
• CVE-2026-65660 — CVE-2026-65660: SharePoint Code Injection Exploited In The Wild (High)
• CVE-2026-67279 — MikroTik RouterOS: Unauthenticated Session Opening Enables Chained Exploitation (High)
• npm:eslint-config-compact-base — Malicious npm package 'eslint-config-compact-base' beacons host reconnaissance data (High)
• npm:ubiquiti-agents-link-mcp — Critical npm Package 'ubiquiti-agents-link-mcp' Compromises Systems (High)
• npm:simplenewnpmpackage — Malicious npm package 'simplenewnpmpackage' performs dependency confusion probing (High)
• npm:com.apple.unityplugin.storekit — Malicious npm package 'com.apple.unityplugin.storekit' performs dependency confusion reconnaissance (High)
• CVE-2026-93616 — Check Point Path Traversal: Unauthenticated RCE in Management Servers (KEV) (Critical)
• CVE-2026-94127 — F5 BIG-IP APM Heap Overflow: Unauthenticated RCE, CISA KEV Listed (High)
• CVE-2026-93952 — Arista VeloCloud Orchestrator: Improper Input Validation Leads to Remote Compromise (High)
• npm:cisco-github-simple — Malicious npm package `cisco-github-simple` leaks host reconnaissance (High)
• npm:take-home-caller-id — Malicious npm package 'take-home-caller-id' performs reconnaissance and data exfiltration (High)
• CVE-2026-7273 — Zyxel GS1900 Switches: Unauthenticated LAN OS Command Execution (KEV) (High)
• npm:@woodpecker-web-shared/components — Malicious npm package @woodpecker-web-shared/components exfiltrates host data (High)
• npm:hardhat-devkit — Malicious 'hardhat-devkit' npm Package Targets Crypto Wallets (High)
• pip:py-venv-doctor — Malicious py-venv-doctor (PyPI) Exfiltrates Environment Variables (High)
• npm:@pwaplatform/module-sso-integration — Malicious npm Package: @pwaplatform/module-sso-integration v99.0.0 Identified (High)
• npm:keroeltop — Malicious npm package 'keroeltop' identified communicating with suspicious domain (High)
• pip:urc — Malicious pip package 'urc' exfiltrates host data upon installation (High)
• CVE-2025-39682 — Linux Kernel TLS Vulnerability: Zero-Length Record Bypass Leads to Incorrect Processing (High)
• npm:test899-auth — Critical Malware in npm Package 'test899-auth' Compromises Systems (High)
• npm:openmct-heatmap — CRITICAL: Malicious npm package 'openmct-heatmap' leads to full system compromise (High)
• CVE-2026-53266 — Linux Kernel Out-of-Bounds Write: Critical for EoL Systems (Low)
• CVE-2025-39964 — Linux Kernel Race Condition: Data Inconsistency & State Corruption via AF_ALG Socket (Moderate)
• npm:ragacateslikodi — Critical Malicious npm Package 'ragacateslikodi' Scrapes Localhost Data (High)
• npm:tailwindcss-contact-form — Critical Malicious npm Package: `tailwindcss-contact-form` Disguised as Forms Plugin (High)
• CVE-2026-87886 — Acronis Backup Plugin Privilege Escalation (CVE-2026-87886) Exploited In Wild (Low)
• CVE-2026-76460 — Cisco ISE Vulnerability: Unauthenticated Remote Access Bypass via Privileged API Misuse (Low)
• npm:strapi-plugin-pysh-meeb — Malicious npm package `strapi-plugin-pysh-meeb` opens remote shell via typosquatting (High)
• npm:strapi-plugin-os-rec — Malicious npm package 'strapi-plugin-os-rec' performs host reconnaissance (High)
• CVE-2026-58704 — Google Pixel Modem Vulnerability: Privilege Escalation via Improper Authorization (Low)
• npm:@biz44/process-runtime-utils — Malicious npm package @biz44/process-runtime-utils executes remote code (High)
• npm:tailwind-forms-styles — Critical Malicious npm Package: tailwind-forms-styles Compromises Systems (High)
• CVE-2026-76461 — Cisco Secure Email Gateway SQLi: Unauthenticated Root RCE, Actively Exploited (High)
• npm:web-main — Critical npm package 'web-main' (v22.1.2) performs host reconnaissance on install (High)
• npm:app-rrhh — Malicious npm package 'app-rrhh' (v999.0.0) identified in dependency confusion attack (High)
• npm:ida-gado-gado47-ruro — Malicious npm Package 'ida-gado-gado47-ruro' Floods Registry with Junk (High)
• npm:ida-gado-gado74-sukiwir — Malicious npm package 'ida-gado-gado74-sukiwir' pollutes registry, alters package metadata (High)
• pip:platform-telemetry-client — Critical Malicious Package: 'platform-telemetry-client' in PyPI Ecosystem (High)
• pip:python-fork — Critical: Malicious 'python-fork' (pip) package deploys system-destabilizing fork bomb (High)
• CVE-2026-42018 — JFrog Artifactory Improper Auth: Internal Tokens Exposed, Sensitive Resources at Risk (High)
• CVE-2026-42016 — JFrog Artifactory Privilege Escalation: Incorrect Authorization in Token Validation (High)
• CVE-2026-84869 — ConnectWise ScreenConnect: Privilege Management & Auth Bypass in KEV (High)
• pip:pymem-win — Malicious 'pymem-win' package in PyPI executes remote code during import (High)
• pip:web3-eth-account — Malicious 'web3-eth-account' (pip) Poses Critical Supply Chain Risk (High)
• CVE-2026-67277 — MikroTik RouterOS Kernel Memory Disclosure & DoS via Missing Authentication (KEV) (High)
• CVE-2026-86060 — MikroTik RouterOS Privilege Escalation (KEV): Policy Mask Manipulation (High)
• npm:far-jade-porcupine — Malicious npm package 'far-jade-porcupine' pollutes registry, impacts build integrity (High)
• npm:far-gray-pike — Critical Malicious Package 'far-gray-pike' Identified in npm Ecosystem (High)
• CVE-2026-87491 — Chromium V8 Out-of-Bounds Write: Remote Code Execution via Crafted HTML (High)
• CVE-2025-25249 — Fortinet Heap Buffer Overflow (CVE-2025-25249) Actively Exploited in the Wild (High)
• CVE-2026-19490 — Citrix NetScaler Auth Bypass (CVE-2026-19490) in KEV: Critical Risk to AAA/VPN (Critical)
• npm:graphql-js-client-transform — Critical Supply-Chain Alert: Malicious 'graphql-js-client-transform' npm Package (High)
• npm:sams-text-style — Critical Malicious npm Package 'sams-text-style' Compromises Systems (High)
• CVE-2026-86218 — N-able N-central Pre-Auth RCE: Critical Risk for Managed Environments (High)
• CVE-2026-81963 — Microsoft Windows Update Stack Privilege Escalation (KEV) (High)
• CVE-2026-75650 — Adobe Commerce/Magento RCE: Template Engine Vulnerability Actively Exploited (High)
• pip:tsshare — CRITICAL: Malicious 'tsshare' package in PyPI contains obfuscated code (High)
• npm:@usemosaik/template-react-js — Critical Supply-Chain Alert: Malicious npm Package @usemosaik/template-react-js (High)
• npm:@opap/player-kyc-widget — Critical Malware Detected in npm Package @opap/player-kyc-widget (High)
• npm:@aircanada/components — Critical Supply Chain Alert: Malicious @aircanada/components npm Package (High)
• npm:@liuliang520500/sinataoke_cn_test — Critical Malware in npm Package @liuliang5520500/sinataoke_cn_test (High)
• pip:minecraftmodes — Critical Malicious Package 'minecraftmodes' in PyPI Exfiltrates Roblox Cookies (High)
• pip:dbt-sa-cli — Malicious pip package 'dbt-sa-cli' (v0.0.1) exfiltrates host information (High)
• pip:proxycer — Malicious 'proxycer' package in PyPI uses typosquatting for data exfiltration (High)
• CVE-2026-85046 — Type Confusion in Chromium V8: Remote Code Execution via Crafted HTML (High)
• pip:qoeoe — Malicious 'qoeoe' (PyPI) Package Exfiltrates Files, Poses Supply Chain Risk (High)
• npm:@crysnovax/plug — Critical npm Package @crysnovax/plug Compromises Systems, Demands Immediate Action (High)
• npm:@a23842/dsh-notifier — Critical Malware in npm Package @a23842/dsh-notifier (High)
• npm:html_vue — CRITICAL: Malicious 'html_vue' npm package compromises host systems (High)
• CVE-2026-49869 — Kestra OSS OS Command Injection: Unauthenticated Remote Workflow Execution (High)
• CVE-2026-48710 — Kludex Starlette HTTP Request Smuggling: Authentication Bypass Risk (KEV) (Critical)
• CVE-2026-59822 — BerriAI LiteLLM Improper Authentication in MCP Streamable HTTP Endpoint (High)
• npm:is-generator-check — Critical npm package 'is-generator-check' compromises systems, rotate all secrets (High)
• npm:onceaction — Critical Malicious 'onceaction' npm Package Compromises Systems (High)
• npm:react-mongoose — Critical Malicious 'react-mongoose' npm Package Compromises Systems (High)
• pip:tallyboxlite — Malicious 'tallyboxlite' PyPI Package Exfiltrates Basic Host Information (High)
• npm:tailwind-modernanimation — Critical Malicious Package Found in npm: tailwind-modernanimation (High)
• npm:@testrelic/appium-analytics — Critical Malware Alert: @testrelic/appium-analytics (npm) Compromises Systems (High)
• CVE-2026-81578 — PaperCut NG/MF Critical Function Vulnerability: Unauthenticated Remote Configuration Modification (Moderate)
• CVE-2026-82078 — PaperCut NG/MF Unsafe Reflection Vulnerability Allows System Configuration Manipulation (Moderate)
• npm:real-browser-plus — Critical npm Package 'real-browser-plus' Compromises Systems (High)
• npm:cloudfcrxz — Critical npm Package 'cloudfcrxz' Compromises Systems, Demands Immediate Action (High)
• npm:mfakit — Malicious npm package 'mfakit' (v1.4.0) targets Windows systems for persistent compromise (High)
• npm:vs-modules — Critical Malicious Package 'vs-modules' in npm Executes Remote Code on Install (High)
• npm:ozturk-mfa — Critical npm package 'ozturk-mfa' compromises host systems (High)
• pip:CalcBoxLite — Malicious pip package 'CalcBoxLite' beacons installer identity (High)
• npm:@hd-team/app-impkg-test — Critical Malware in npm Package @hd-team/app-impkg-test Poses Full System Compromise (High)
• npm:pushgitquickx — Critical: Malicious npm package 'pushgitquickx' compromises systems (Critical)
• CVE-2026-66384 — JFrog Artifactory Path Traversal: Authenticated Data Write Outside Intended Path (Moderate)
• CVE-2026-53362 — Linux Kernel IPv6 Privilege Escalation: In-the-Wild Exploitation Confirmed (Moderate)
• CVE-2023-49105 — ownCloud Improper Authentication: Critical Risk of Unauthorized File Access (Critical)
• npm:@fongsidev/scraper — Critical npm package '@fongsidev/scraper' leads to full system compromise (High)
• npm:@lordmega/baileys — Critical Malware Alert: npm package @lordmega/baileys Compromises Systems (High)
• CVE-2026-60004 — Gitea Code Injection: Repository Write Access Leads to Arbitrary Code Execution (Low)
• npm:mc-provider — Critical Malicious npm Package 'mc-provider' Poses Full System Compromise Risk (High)
• npm:statist-browser-typed-client-mb.product.analytics — CRITICAL: Malicious npm package 'statist-browser-typed-client-mb.product.analytics' compromises systems (High)
• CVE-2026-21962 — Oracle HTTP Server Proxy Plug-in: Critical Improper Access Control Vulnerability (KEV) (Critical)
• npm:security-node — Critical npm 'security-node' package compromise: immediate action required (High)
• npm:shopping-shared-atom-mobile-cart-counter — Critical npm Package 'shopping-shared-atom-mobile-cart-counter' Compromises Systems (High)
• npm:solidity-testing-utils — Malicious npm package 'solidity-testing-utils' (v1.2.0) facilitates credential theft (High)
• npm:fund-list-filter — Malicious npm Package 'fund-list-filter' Identified (High)
• npm:lumen-pages-community — Malicious npm package 'lumen-pages-community' exfiltrates system data on install (High)
• npm:@postman-cse/okta-aio-linux-arm64 — Critical Malware in npm Package @postman-cse/okta-aio-linux-arm64 (High)
• CVE-2026-73570 — Zimbra OS Command Injection: Unauthenticated RCE via Malicious SMTP Requests (High)
• pip:requests-crypt — Critical Malicious Package 'requests-crypt' in PyPI Contains Hidden Backdoor (High)
• npm:saas-f-testing — Critical npm Package 'saas-f-testing' Compromises Systems (High)
• CVE-2026-72529 — TrueConf Server: Critical Function Missing Authentication Allows Remote Script Execution (Moderate)
• CVE-2026-72530 — TrueConf Server Code Injection: Remote Code Execution via Port 4307/TCP (Moderate)
• npm:debug-fnt — Critical npm Package 'debug-fnt' Compromises Systems, Demands Immediate Action (High)
• npm:loadutils — Critical: Malicious 'loadutils' npm Package Compromises Systems (High)
• CVE-2026-64849 — MLflow SSRF: Internal Service Exposure via Server-Side Request Forgery (High)
• npm:gear-composer — Malicious npm package 'gear-composer' (v1.0.126) identified in credential theft campaign (High)
• npm:digital-interview-digital-interview-core — Critical Malware in npm Package 'digital-interview-digital-interview-core' (High)
• CVE-2026-55040 — Microsoft SharePoint Weak Auth Bypass: Critical Risk, In-the-Wild Exploitation (Critical)
• CVE-2026-59310 — VMware vCenter Path Traversal: Remote Code Execution Risk (High)
• CVE-2026-33824 — CISA KEV: Microsoft IKE Double Free Enables Remote Code Execution (Critical)
• npm:checkout-mobile-pay-button — Critical Malicious npm Package: 'checkout-mobile-pay-button' Compromises Systems (High)
• npm:@oyo_tech/oyochat_user — Malicious npm package @oyo_tech/oyochat_user identified in supply chain (High)
• CVE-2025-62593 — Ray-Project Ray Code Injection: Remote Code Execution via Firefox/Safari (Moderate)
• npm:sugarball-cli — Critical Malicious npm Package 'sugarball-cli' Poses Full System Compromise Risk (High)
• npm:arc-diag-util — Critical: Malicious 'arc-diag-util' npm Package Compromises Systems (High)
• npm:hunterone-build-probe-9210 — Critical npm package 'hunterone-build-probe-9210' steals credentials (High)
• npm:depcruise-wrap-stream-in-html — Critical Malicious npm Package: depcruise-wrap-stream-in-html (High)
• npm:kit-hydration-vim — Critical npm package 'kit-hydration-vim' leads to full system compromise (High)
• npm:svelte-goal-vim — Critical npm Package 'svelte-goal-vim' Compromises Systems (High)
• npm:amplitude-ma-ts — Critical npm package 'amplitude-ma-ts' identified as malware, leading to full compromise (High)
• npm:angular2-tesla-common — Critical Malicious npm Package 'angular2-tesla-common' Poses Full System Compromise Risk (High)
• npm:cc-skills-helper — Critical npm Package 'cc-skills-helper' Delivers Windows-Only Dropper (High)
• npm:nolimit-agent — Critical npm Package 'nolimit-agent' Compromises Systems (Critical)
• npm:@years18/n8n-nodes-utils-helper-t — Critical Malicious npm Package: @years18/n8n-nodes-utils-helper-t (High)
• npm:permit2 — Critical npm package 'permit2' identified as credential-stealing supply-chain threat (High)
• CVE-2026-72898 — Metabase SQLi: Unauthenticated Admin Access, Data Theft, and Configuration Tampering (High)
• CVE-2026-68820 — CVE-2026-68820: Windows AFD Use-After-Free Allows Local Privilege Escalation (Low)
• CVE-2026-20349 — Cisco Secure Firewall DoS Vulnerability Actively Exploited in the Wild (Low)
• npm:developer-dashboard — Critical npm Package 'developer-dashboard' Compromises Systems (High)
• npm:tilaver-mfa — Critical Supply Chain Alert: Malicious 'tilaver-mfa' npm Package Discovered (High)
• pip:pytablute — Critical Malicious Package 'pytablute' in PyPI Downloads Second-Stage Code (High)
• pip:chaintest — Critical Malicious PyPI Package 'chaintest' Steals Credentials and Crypto (High)
• npm:statist-browser-typed-client-eventea.projects.pwakasko — Critical npm Package 'statist-browser-typed-client-eventea.projects.pwakasko' Compromises Systems (High)
• pip:riakcs — Malicious pip package 'riakcs' (v0.0.1) exfiltrates host data on install (High)
• npm:sme-rko-finance-front-payments-domain — Critical Malicious npm Package: 'sme-rko-finance-front-payments-domain' Downloads Binaries (High)
• CVE-2026-8037 — Progress LoadMaster Command Injection: Critical Risk to Network Infrastructure (Critical)
• npm:gas-diff-core — Critical Malicious npm Package 'gas-diff-core' Targets Crypto Wallets (High)
• npm:postcss-theme-provider — Critical Malicious npm Package: 'postcss-theme-provider' Targets Crypto Wallets (High)
• npm:vitest-preview-pro-all — Critical Malicious npm Package: 'vitest-preview-pro-all' Enables Remote Code Execution (High)
• npm:tsihealth-client — Critical Malicious npm Package: 'tsihealth-client' Establishes Remote Control (High)
• CVE-2026-63077 — JetBrains TeamCity Deserialization RCE: Unauthenticated Threat via Agent Polling (High)
• npm:trapp-configuration — CRITICAL: Malicious 'trapp-configuration' npm Package Compromises Systems (High)
• npm:devplatform-vite-plugin-external — Critical Malicious npm Package 'devplatform-vite-plugin-external' Compromises Systems (High)
• CVE-2026-9198 — IBM Langflow Code Injection: Unauthenticated RCE in Default Deployments (Critical)
• CVE-2026-34486 — Apache Tomcat Encryption Bypass (CVE-2026-34486) Actively Exploited (Critical)
• CVE-2026-18556 — N-able N-central Authentication Bypass (CVE-2026-18556) Exploited In The Wild (Moderate)
• npm:@servicetitan/standalone-core-feature-gates — Critical npm package @servicetitan/standalone-core-feature-gates compromises systems (High)
• npm:@servicetitan/examples — Critical npm Package @servicetitan/examples Compromised (High)
• CVE-2026-18577 — N-able N-central Auth Bypass (CVE-2026-18577) Allows Account Takeover (Critical)
• npm:beaver-ui-header — Critical Malicious npm Package 'beaver-ui-header' Compromises Systems (High)
• npm:internallib_v568 — Critical npm Package 'internallib_v568' Compromises Systems (High)
• npm:pp-react-worldready — Malicious npm package 'pp-react-worldready' identified, communicates with malicious domain (High)
• pip:wacve-utils — Critical Malicious Package 'wacve-utils' in PyPI Targets Linux/Android Data (High)
• pip:nvtorch-oot-nightly — Malicious pip package 'nvtorch-oot-nightly' exfiltrates host information (High)
• pip:trtllm-subdir-test — Malicious PyPI Package 'trtllm-subdir-test' Exfiltrates Host Information (High)
• pip:cognikit — Critical Malicious 'cognikit' Package in PyPI Steals Credentials and Enables Remote Control (High)
• pip:walmart-genai-trace — Critical Malicious Package: 'walmart-genai-trace' in PyPI Exfiltrates Host Info (High)
• npm:js-client-node — Critical Malicious npm Package 'js-client-node' Compromises Systems (High)
• npm:@wbnr/design — Malicious npm package @wbnr/design identified, communicates with malicious domain (High)
• CVE-2026-20316 — Cisco Secure Firewall Management Center Hard-Coded Password Vulnerability (KEV) (High)
• npm:poly-kelly — Critical npm Package 'poly-kelly' Compromises Systems for Credential Theft (High)
• npm:polymarket-risk-manager — Critical Malicious npm Package 'polymarket-risk-manager' Compromises Systems (High)
• npm:lib-mtop — CRITICAL: Malicious npm package 'lib-mtop' leads to full system compromise (High)
• npm:local-config-parser — Critical npm package 'local-config-parser' identified as malware (High)
• CVE-2026-16812 — Arista VeloCloud Orchestrator OS Command Injection: Critical Risk to Orchestrator Hosts (High)
• npm:pp-react-ui5 — Critical Malware Alert: npm package 'pp-react-ui5' leads to full system compromise (High)
• npm:payoutsvettingserv-paypal — Critical npm Package 'payoutsvettingserv-paypal' Compromises Systems (High)
• CVE-2025-68686 — Fortinet FortiOS: Post-Exploitation Information Exposure in KEV (Moderate)
• npm:@antv/g-plugin-dom-interaction — Critical npm Package Compromise: @antv/g-plugin-dom-interaction Steals Credentials (High)
• npm:@antv/g-plugin-svg-picker — Critical Malicious npm Package: @antv/g-plugin-svg-picker Steals Credentials (High)
• npm:-john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love — Critical Malicious npm Package: '-john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love' (High)
• npm:-whareo-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-home — Malicious npm package '-whareo-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-home' identified (High)
• npm:app-data-ist — Critical: Malicious 'app-data-ist' npm Package Compromises Systems (High)
• npm:app-node-layer — Critical npm package 'app-node-layer' leads to full system compromise (High)
• CVE-2026-50522 — Microsoft SharePoint Deserialization Vulnerability Actively Exploited (KEV) (Critical)
• npm:svelte-streak-metrics — Critical: Malicious 'svelte-streak-metrics' npm Package Compromises Systems (High)
• npm:streak-lib-math — Critical npm Package 'streak-lib-math' Compromises Systems (High)
• CVE-2026-16232 — Check Point SmartConsole Improper Authentication Allows Full Admin Access (High)
• npm:veldora — Critical npm Package 'veldora' Compromises Systems, Demands Immediate Action (High)
• npm:kijai — Critical: Malicious 'kijai' npm Package Compromises Systems (High)
• CVE-2026-63030 — WordPress Core SQLi/RCE: Critical Vulnerability Exploited in the Wild (Critical)
• pip:ztasimb — Critical Malicious Package 'ztasimb' Identified in PyPI Ecosystem (High)
• pip:zmaker — Malicious 'zmaker' (PyPI) Package Part of Telegram Data Exfiltration Campaign (High)
• CVE-2026-0770 — Langflow RCE: Critical Vulnerability Actively Exploited in the Wild (Critical)
• CVE-2026-60137 — WordPress Core SQLi: Chained RCE for Unauthenticated Attackers (Critical)
• npm:lambda-cloudwatch-cdk — Critical Malware in npm Package 'lambda-cloudwatch-cdk' Poses Full Compromise Risk (High)
• npm:iot-kfh-s3 — Critical npm package 'iot-kfh-s3' compromises host systems (High)
• rust:semantic-search-client — Malicious Rust Package 'semantic-search-client' Identified in crates.io (High)
• rust:supertag — Malicious Rust Package 'supertag' (v99.1.1) Identified (High)
• rust:replit_ruspty — Malicious Rust Package 'replit_ruspty' Identified in crates.io (High)
• rust:proton-pfff — Malicious Rust Package 'proton-pfff' Identified in crates.io (High)
• CVE-2026-39808 — FortiSandbox OS Command Injection: Unauthenticated RCE, Actively Exploited (Critical)
• npm:scan-only — Critical Malicious 'scan-only' npm Package Compromises Systems (High)
• npm:anthropic-claude-latest — Critical npm Package 'anthropic-claude-latest' Compromises Systems (High)
• CVE-2026-25089 — FortiSandbox OS Command Injection: Unauthenticated RCE, Actively Exploited (Critical)
• CVE-2026-58644 — Microsoft SharePoint Deserialization Flaw: Remote Code Execution Risk (High)
• npm:ai-p2p — Critical npm Package 'ai-p2p' Compromises Systems, Steals Credentials (High)
• npm:loader1 — CRITICAL: Malicious npm package 'loader1' compromises systems (High)
• npm:datefmt-helper — CRITICAL: Malicious 'datefmt-helper' npm package compromises systems (High)
• pip:fflask — Critical Typosquatting: Malicious 'fflask' Package in PyPI Ecosystem (High)
• CVE-2026-56155 — Microsoft ADFS Privilege Escalation (CVE-2026-56155) Actively Exploited (Moderate)
• CVE-2023-4346 — KNX Protocol Lockout Mechanism Allows Device Purge and Lockout (Moderate)
• CVE-2026-46817 — Oracle E-Business Suite Payments Vulnerability: Unauthenticated Takeover Risk (High)
• npm:monitoring-service-util — Critical: Malicious 'monitoring-service-util' npm package compromises systems (High)
• npm:node-fsagent — Critical npm package 'node-fsagent' compromises systems, enabling credential theft (Critical)
• npm:react-dynammic-table-component — Critical npm Package 'react-dynammic-table-component' Leads to Full Compromise (High)
• npm:babel-preset-lib-client — Critical npm package 'babel-preset-lib-client' compromises systems (High)
• CVE-2008-4128 — Cisco IOS Cross-Site Forgery: Remote Command Execution Risk (Critical)
• npm:type-atob — CRITICAL: Malicious 'type-atob' npm package compromises systems (High)
• npm:type-elint — Critical npm package 'type-elint' compromises systems via supply chain attack (High)
• npm:auth-next-gen — Critical npm Package 'auth-next-gen' Compromises Systems (High)
• npm:authvaultx — CRITICAL: Malicious 'authvaultx' npm Package Compromises Systems (High)
• npm:babel-eslint-parser-legacy — Critical Malware Alert: npm's babel-eslint-parser-legacy Compromises Systems (High)
• npm:@higherlogic/ocfe — CRITICAL: Malicious npm package '@higherlogic/ocfe' leads to full system compromise (High)
• CVE-2026-48939 — iCagenda Unrestricted File Upload: Critical for Web Servers Handling User Content (High)
• CVE-2026-56291 — Balbooa Forms Unrestricted File Upload Leads to Remote Code Execution (Moderate)
• npm:promo-helper — Critical npm package 'promo-helper' leads to full system compromise (High)
• npm:common-tg-service — Critical npm Package 'common-tg-service' Compromises Systems (Critical)
• npm:whs4_npm_test — Critical npm Package 'whs4_npm_test' Compromises Systems (High)
• CVE-2026-56290 — Joomlack Page Builder RCE via Unauthenticated Arbitrary File Upload (KEV) (Moderate)
• CVE-2026-55255 — Langflow Auth Bypass: Authenticated Attackers Can Execute Other Users' Flows (Moderate)
• CVE-2026-48908 — JoomShaper SP Page Builder: Unrestricted File Upload Leads to Remote Code Execution (High)
• npm:xnder-sdk-js — Critical npm package 'xnder-sdk-js' compromises systems via supply-chain attack (High)
• npm:@jaime9008/math-service — Critical Malware in npm Package @jaime9008/math-service (High)
• npm:@node-cloud/create — Critical npm package '@node-cloud/create' identified as malware (High)
• npm:@sql-trigger/nodesql — CRITICAL: Malicious npm package @sql-trigger/nodesql leads to full system compromise (High)
• npm:alder_morrgan — CRITICAL: Malicious npm package 'alder_morrgan' compromises systems (High)
• npm:api-node-utils — Critical Malicious npm Package 'api-node-utils' Compromises Systems (High)
• npm:web-api-node — Critical npm package 'web-api-node' identified as malware, leading to full compromise (High)
• npm:typescript-util-core — Critical Supply-Chain Alert: Malicious 'typescript-util-core' npm Package (High)
• npm:db-convertor — Critical Malicious npm Package 'db-convertor' Poses Full System Compromise Risk (High)
• npm:animatecss-postcss-plugin — Critical npm Package 'animatecss-postcss-plugin' Compromises Systems (High)
• npm:rebrandly-domains-search-client — Critical Malware Alert: npm package 'rebrandly-domains-search-client' Compromises Systems (High)
• npm:chai-as-persisted — Critical npm Package 'chai-as-persisted' Compromises Host Systems (High)
• CVE-2026-45659 — Microsoft SharePoint Server Deserialization Vulnerability Exploited In The Wild (Critical)
• npm:endpointmap — CRITICAL: Malicious 'endpointmap' npm package compromises host systems (High)
• npm:procwire — Critical Malicious npm Package 'procwire' Poses Full System Compromise Risk (High)
• npm:autotel-backends — Critical npm package 'autotel-backends' v2.12.26 compromises host systems (High)
• npm:autotel-cli — Critical npm package 'autotel-cli' v0.8.14 compromises host systems (High)
• CVE-2026-20230 — Cisco Unified CM SSRF: Critical RCE Risk, Actively Exploited in the Wild (Critical)
• CVE-2026-12569 — PTC Windchill/FlexPLM: Unauthenticated RCE via Input Validation Flaw (KEV) (High)
• CVE-2026-48558 — SimpleHelp OIDC Auth Bypass: Forged Tokens Grant Full Technician Access (High)
• npm:velocityfix — Critical: Malicious 'velocityfix' npm package compromises systems (Critical)
• npm:hunsterx-package — Critical Supply-Chain Alert: Malicious 'hunsterx-package' in npm Ecosystem (High)
• CVE-2024-3094 — Critical XZ Utils Backdoor: Pre-Auth RCE in Internet-Facing Systems (Critical)