{"title":"Open source advisories","description":"Advisories for open-source maintainers and consumers: disclosure floods, patch backlogs and AI-generated reports.","home":"https://vulnpocalypse.dev/feeds/","items":[{"id":"https://vulnpocalypse.dev/advisories/github-issue-comment-injection-campaign/","title":"GitHub issue and PR comment injection: 83 hidden shell payloads hit workflows in 61 public repositories","url":"https://vulnpocalypse.dev/advisories/github-issue-comment-injection-campaign/","date":"2026-11-12","summary":"Hidden shell commands in GitHub issues, PRs and comments hit 61 repos, including Trivy and MLflow. Find workflows that put issue text into run steps.","tags":["supply-chain","github-actions","ci-cd","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/bufferzonecorp-go-rubygems-ci-stealer/","title":"BufferZoneCorp: 10 Go modules and 7 knot-* Ruby gems stole CI secrets, planted SSH keys and rewired GitHub Actions","url":"https://vulnpocalypse.dev/advisories/bufferzonecorp-go-rubygems-ci-stealer/","date":"2026-11-12","summary":"BufferZoneCorp Go modules and knot-* gems stole SSH, cloud, npm, gh and kube credentials and tampered with GitHub Actions. Check go.mod and Gemfile.lock.","tags":["supply-chain","github-actions","ci-cd","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/palo-alto-networks-discloses-checkov-ssrf-flaw-cve-2026-0323/","title":"Palo Alto Networks discloses Checkov SSRF flaw CVE-2026-0323","url":"https://vulnpocalypse.dev/advisories/palo-alto-networks-discloses-checkov-ssrf-flaw-cve-2026-0323/","date":"2026-11-11","summary":"Palo Alto Networks says Checkov before 3.4.2 has an SSRF flaw, CVE-2026-0323; upgrade to 3.4.2 or later if external module downloads are on.","tags":["exploited","cloud","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/microsoft-reports-threat-actors-using-gsocket-for-persistent-linux-c2/","title":"Microsoft reports threat actors using GSocket for persistent Linux C2","url":"https://vulnpocalypse.dev/advisories/microsoft-reports-threat-actors-using-gsocket-for-persistent-linux-c2/","date":"2026-11-11","summary":"Microsoft reports threat actors deploy GSocket on compromised Linux servers for persistent access; remove the client, not just patch the app.","tags":["ecosystem","web","endpoint","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/endor-labs-reports-openclaw-apply-patch-path-traversal-fixed-in-2026214/","title":"Endor Labs reports OpenClaw apply_patch path traversal, fixed in 2026.2.14","url":"https://vulnpocalypse.dev/advisories/endor-labs-reports-openclaw-apply-patch-path-traversal-fixed-in-2026214/","date":"2026-11-11","summary":"Endor Labs reports a path traversal in OpenClaw apply_patch; the project advisory lists a fix in 2026.2.14, so upgrade openclaw.","tags":["ai-tools","npm","nodejs","ai-tools","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/endor-labs-claims-its-ai-sast-found-26x-more-real-flaws-than-claude/","title":"Endor Labs claims its AI SAST found 2.6x more real flaws than Claude","url":"https://vulnpocalypse.dev/advisories/endor-labs-claims-its-ai-sast-found-26x-more-real-flaws-than-claude/","date":"2026-11-11","summary":"Endor Labs claims its AI SAST found 192 real vulnerabilities in an 8-project benchmark; treat it as a vendor claim and test on your own code.","tags":["ai-tools","ai-tools","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/github-blog-reports-git-2561-fixes-six-security-flaws/","title":"GitHub Blog reports Git 2.56.1 fixes six security flaws","url":"https://vulnpocalypse.dev/advisories/github-blog-reports-git-2561-fixes-six-security-flaws/","date":"2026-11-11","summary":"The GitHub Blog says Git 2.56.1 and backports address six vulnerabilities, including code execution on recursive clone; update Git.","tags":["exploited","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/gbhackers-reports-modsecurity-waf-upload-bypass-and-xml-flaw/","title":"GBHackers reports ModSecurity WAF upload bypass and XML flaw","url":"https://vulnpocalypse.dev/advisories/gbhackers-reports-modsecurity-waf-upload-bypass-and-xml-flaw/","date":"2026-11-11","summary":"GBHackers reports two ModSecurity advisories, an upload filter bypass and an XML bug; set SecParseXmlIntoArgs Off and validate decoded filenames.","tags":["exploited","open-source","web"]},{"id":"https://vulnpocalypse.dev/advisories/ethersphere-bee-js-1330-and-swarm-desktop-0562-compromised/","title":"Ethersphere bee-js 13.3.0 and Swarm Desktop 0.56.2 compromised","url":"https://vulnpocalypse.dev/advisories/ethersphere-bee-js-1330-and-swarm-desktop-0562-compromised/","date":"2026-11-11","summary":"Malicious @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 steal Swarm wallet files; check for them and rotate keys on any affected host.","tags":["supply-chain","npm","nodejs","github-actions","crypto","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/fake-github-security-tool-repos-spread-asyncrat-doctor-web-reports/","title":"Fake GitHub security tool repos spread AsyncRAT, Doctor Web reports","url":"https://vulnpocalypse.dev/advisories/fake-github-security-tool-repos-spread-asyncrat-doctor-web-reports/","date":"2026-11-11","summary":"Doctor Web reports fake GitHub security tool repos infected over 2,000 PCs; inspect build steps before running any cloned project.","tags":["supply-chain","open-source","endpoint","crypto"]},{"id":"https://vulnpocalypse.dev/advisories/claude-code-settingslocaljson-leaks-secrets-to-public-github-repos/","title":"Claude Code settings.local.json leaks secrets to public GitHub repos","url":"https://vulnpocalypse.dev/advisories/claude-code-settingslocaljson-leaks-secrets-to-public-github-repos/","date":"2026-11-11","summary":"Claude Code can save approved commands with secrets in .claude/settings.local.json, found in public GitHub repos; rotate any credential it ever held.","tags":["ai-tools","ai-tools","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/openssh-alpine-musl-password-auth-bypass/","title":"OpenSSH password bypass on Alpine and musl without PAM: locked accounts accept long passwords","url":"https://vulnpocalypse.dev/advisories/openssh-alpine-musl-password-auth-bypass/","date":"2026-11-11","summary":"On Alpine and musl systems with sshd built without PAM, a locked account accepts any long password. Update openssh and restart sshd.","tags":["exploited","open-source","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/openai-gpt6-cyber-948-linux-flaws/","title":"OpenAI's GPT-6 Cyber model generated 948 working Linux kernel root exploits and reported 81 Firefox flaws","url":"https://vulnpocalypse.dev/advisories/openai-gpt6-cyber-948-linux-flaws/","date":"2026-11-11","summary":"OpenAI's GPT-6 Cyber built 948 working Linux kernel root exploits and reported 81 high-severity Firefox flaws, all disclosed for patching.","tags":["ai-tools","ai-tools","open-source","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/debian-and-ubuntu-apt-flaw-cve-2026-109518-lets-a-mitm-swap-verified-packages-an/","title":"Debian and Ubuntu APT flaw CVE-2026-109518 lets a MitM swap verified packages and run code as root","url":"https://vulnpocalypse.dev/advisories/debian-and-ubuntu-apt-flaw-cve-2026-109518-lets-a-mitm-swap-verified-packages-an/","date":"2026-11-11","summary":"A flaw in APT, tracked as CVE-2026-109518, lets a network attacker swap a verified package for a malicious one and run code as root on Debian and Ubuntu.","tags":["exploited","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/critical-rails-active-storage-flaw-lets-crafted-imagemagick-uploads-write-server/","title":"Critical Rails Active Storage flaw lets crafted ImageMagick uploads write server files","url":"https://vulnpocalypse.dev/advisories/critical-rails-active-storage-flaw-lets-crafted-imagemagick-uploads-write-server/","date":"2026-11-11","summary":"A critical Rails Active Storage flaw lets unauthenticated uploads write files through ImageMagick, fixed in activestorage 8.1.4.1 and 8.0.5.2.","tags":["exploited","web","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/artex-ai-framework-exposed-korean-banks/","title":"ARTEX AI pentest operators exposed their own servers, revealing an agentic hacking campaign against South Korean banks","url":"https://vulnpocalypse.dev/advisories/artex-ai-framework-exposed-korean-banks/","date":"2026-11-11","summary":"Operators of the China-made ARTEX AI pentest framework left servers open, exposing Claude Code and DeepSeek-driven tooling tied to breaches at seven South.","tags":["ai-tools","ai-tools","enterprise","cloud","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/solanacry-fake-solana-github-repo-lures-ai-coding-agents-hackread-reports/","title":"SolanaCry: fake Solana GitHub repo lures AI coding agents, Hackread reports","url":"https://vulnpocalypse.dev/advisories/solanacry-fake-solana-github-repo-lures-ai-coding-agents-hackread-reports/","date":"2026-11-11","summary":"Hackread reports a fake GitHub Solana starter kit tells AI agents to install NetSupport RAT; review commands before agents run them.","tags":["supply-chain","ai-tools","open-source","crypto","endpoint"]},{"id":"https://vulnpocalypse.dev/advisories/cursor-claude-code-extension-backdoor/","title":"Trojanized Claude Code extension on Cursor's marketplace planted an SSH backdoor (2.1.312, 2.1.313), plus","url":"https://vulnpocalypse.dev/advisories/cursor-claude-code-extension-backdoor/","date":"2026-11-11","summary":"Fake Claude Code 2.1.312 and 2.1.313 on Cursor's marketplace added an attacker SSH key and reverse tunnel. Check authorized_keys for svc-telemetry.","tags":["supply-chain","ai-tools","endpoint","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/android-sms-of-death-wap-push/","title":"Android \"SMS of Death\": a zero-click WAP push SMS crashes the phone process and drops calls (CVE-2026-58882","url":"https://vulnpocalypse.dev/advisories/android-sms-of-death-wap-push/","date":"2026-11-11","summary":"One crafted WAP push SMS crashes com.android.phone on Android 12 to 16, dropping calls. Install the October 2026 patch; Android 12 and 13 get no fix.","tags":["exploited","endpoint","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/drupal-commerce-cve-2026-118539/","title":"Drupal Commerce Core CVE-2026-118539: highly critical access bypass exploited against online stores","url":"https://vulnpocalypse.dev/advisories/drupal-commerce-cve-2026-118539/","date":"2026-11-11","summary":"An exploited access bypass in Drupal Commerce Core can cost store owners money. Update to Commerce 3.3.13 or 8.x-2.41 and audit recent orders.","tags":["exploited","php","web","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/anthropic-ai-model-chained-flaws-into-chrome-safari-android-windows-and-linux-ex/","title":"Anthropic AI model chained flaws into Chrome, Safari, Android, Windows and Linux exploits","url":"https://vulnpocalypse.dev/advisories/anthropic-ai-model-chained-flaws-into-chrome-safari-android-windows-and-linux-ex/","date":"2026-11-11","summary":"Anthropic says an unreleased model chained flaws into five working exploits for Chrome, Safari, Android, Windows and Linux, all reported and patched.","tags":["ai-tools","ai-tools","web","endpoint","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/growi-jvn-discloses-three-authorization-flaws-up-to-v806-fixed-in-v807/","title":"GROWI: JVN discloses three authorization flaws up to v8.0.6, fixed in v8.0.7","url":"https://vulnpocalypse.dev/advisories/growi-jvn-discloses-three-authorization-flaws-up-to-v806-fixed-in-v807/","date":"2026-11-11","summary":"JVN discloses three authorization flaws in GROWI up to v8.0.6 that let users read or alter pages they should not, so upgrade GROWI to v8.0.7.","tags":["exploited","web","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/popcorn-time-fork-updater-left-devices-open-to-hijacking-malwarebytes-reports/","title":"Popcorn Time fork updater left devices open to hijacking, Malwarebytes reports","url":"https://vulnpocalypse.dev/advisories/popcorn-time-fork-updater-left-devices-open-to-hijacking-malwarebytes-reports/","date":"2026-11-11","summary":"Malwarebytes reports an abandoned Popcorn Time fork updater could run attacker code, so remove Popcorn Time or Time4Popcorn from old devices.","tags":["exploited","endpoint","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/node2shell-brotli-cve-2026-111497/","title":"\"Node2Shell: an out-of-bounds write in Google's Brotli decoder (CVE-2026-111497) reaches far beyond Node.js\"","url":"https://vulnpocalypse.dev/advisories/node2shell-brotli-cve-2026-111497/","date":"2026-11-11","summary":"CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder. Crafted compressed data can crash or run code. Patch Node.js, Brotli, Bun and more.","tags":["exploited","nodejs","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/edk2-pxe-rce-cve-2026-97631/","title":"TianoCore EDK II PXE driver pre-boot RCE (CVE-2026-97631): fixed on main, in no stable release yet","url":"https://vulnpocalypse.dev/advisories/edk2-pxe-rce-cve-2026-97631/","date":"2026-11-11","summary":"An EDK II PXE driver overflow can run code before the OS and Secure Boot. No stable fix yet: disable PXE where unused and isolate boot networks.","tags":["exploited","open-source","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/litellm-11070-on-pypi-and-docker-was-backdoored-with-a-credential-stealer-and-re/","title":"LiteLLM 1.107.0 on PyPI and Docker was backdoored with a credential stealer and remote code loader","url":"https://vulnpocalypse.dev/advisories/litellm-11070-on-pypi-and-docker-was-backdoored-with-a-credential-stealer-and-re/","date":"2026-11-11","summary":"LiteLLM 1.107.0 on PyPI and official Docker images ran a credential stealer on every Python start; roll back to 1.106.2 and rotate all reachable secrets.","tags":["supply-chain","pypi","ai-tools","open-source","ci-cd","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/emudhra-intermediate-ca-compromise/","title":"eMudhra intermediate CA compromise: eight CA keys were guessable in 256 tries, and non-browser clients still need updates","url":"https://vulnpocalypse.dev/advisories/emudhra-intermediate-ca-compromise/","date":"2026-11-11","summary":"Eight eMudhra intermediate CA keys were guessable. Browsers block them; update CA bundles and runtimes, and replace TLS certs under emSign ECC Root CA - G3.","tags":["ecosystem","endpoint","nodejs","pypi","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/artex-ai-pentest-framework-abused-in-data-theft-from-south-korean-banks/","title":"ARTEX AI pentest framework abused in data theft from South Korean banks","url":"https://vulnpocalypse.dev/advisories/artex-ai-pentest-framework-abused-in-data-theft-from-south-korean-banks/","date":"2026-11-11","summary":"A suspected Chinese-speaking, financially motivated actor used the ARTEX agentic pentest tool to steal data from South Korean financial firms.","tags":["ai-tools","ai-tools","open-source","web","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/glasswing-disclosure-wave/","title":"Project Glasswing: AI-found bugs are reaching your dependencies faster than maintainers can patch","url":"https://vulnpocalypse.dev/advisories/glasswing-disclosure-wave/","date":"2026-11-11","summary":"Of 6,157 Glasswing vulnerabilities disclosed to open-source maintainers, about 8% were patched by October 2026. Expect a long tail of dependency fixes.","tags":["ecosystem","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/rejetto-hfs-cve-2026-61500/","title":"Rejetto HFS CVE-2026-61500: an AI-found bug attacked the day after its write-up","url":"https://vulnpocalypse.dev/advisories/rejetto-hfs-cve-2026-61500/","date":"2026-11-11","summary":"A predictable session key in HFS 3.0.0 to 3.2.0, found with Claude Mythos, lets attackers forge an admin login and run code. Update to 3.2.1 or later.","tags":["exploited","nodejs","npm","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/ai-found-vulnerabilities-exploitation-rate/","title":"Mythos-era exploitation statistics: 14 of 1,061 AI-found vulnerabilities exploited, and what Firefox 150's","url":"https://vulnpocalypse.dev/advisories/ai-found-vulnerabilities-exploitation-rate/","date":"2026-11-11","summary":"VulnCheck found 1.3% of AI-found vulnerabilities exploited in 1H 2026, the same as all bugs. Patch AI-found CVEs by exposure, not by how they were found.","tags":["ai-tools","ai-tools","vuln-data","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/nvd-stops-enriching-most-cves/","title":"NVD stops enriching most CVEs: your scanner's severity data now has gaps","url":"https://vulnpocalypse.dev/advisories/nvd-stops-enriching-most-cves/","date":"2026-11-11","summary":"Since 15 April 2026 NIST no longer adds severity scores or product data to most new CVEs. Tools that match on NVD data miss or misjudge risk.","tags":["ecosystem","vuln-data","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/curl-ends-bug-bounty-ai-slop/","title":"curl ends its bug bounty over AI slop: what every maintainer should set up now","url":"https://vulnpocalypse.dev/advisories/curl-ends-bug-bounty-ai-slop/","date":"2026-11-11","summary":"curl closed its HackerOne bug bounty on 31 January 2026 to stop paying for invented AI reports. How maintainers can filter the flood without missing real bugs.","tags":["ecosystem","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/vulncheck-says-anthropic-glasswing-cves-are-few-fixes-lag/","title":"VulnCheck says Anthropic Glasswing CVEs are few, fixes lag","url":"https://vulnpocalypse.dev/advisories/vulncheck-says-anthropic-glasswing-cves-are-few-fixes-lag/","date":"2026-11-10","summary":"VulnCheck says 442 CVEs trace to Anthropic's Glasswing, 2 exploited; check those two CVEs and treat scanner reports as unverified.","tags":["ai-tools","ai-tools","open-source","vuln-data"]},{"id":"https://vulnpocalypse.dev/advisories/researcher-says-100-flaws-found-in-uk-government-public-code-per-wired/","title":"Researcher says 100+ flaws found in UK government public code, per Wired","url":"https://vulnpocalypse.dev/advisories/researcher-says-100-flaws-found-in-uk-government-public-code-per-wired/","date":"2026-11-10","summary":"Wired reports a researcher says he found over 100 vulnerabilities in public UK government code; check your repos for committed secrets.","tags":["ai-tools","open-source","cloud","ai-tools","enterprise"]},{"id":"https://vulnpocalypse.dev/advisories/near-ai-breached-via-sglang-rce-flaw-18-agents-and-100-users-hit/","title":"NEAR AI breached via SGLang RCE flaw, 18 agents and 100 users hit","url":"https://vulnpocalypse.dev/advisories/near-ai-breached-via-sglang-rce-flaw-18-agents-and-100-users-hit/","date":"2026-11-10","summary":"An SGLang RCE flaw let an attacker into NEAR AI systems; users should check for direct mail from security@near.ai and be wary of unsolicited messages.","tags":["ai-tools","ai-tools","cloud","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/help-net-security-reports-xorg-fixes-eight-x-server-and-xwayland-flaws/","title":"Help Net Security reports X.Org fixes eight X server and Xwayland flaws","url":"https://vulnpocalypse.dev/advisories/help-net-security-reports-xorg-fixes-eight-x-server-and-xwayland-flaws/","date":"2026-11-10","summary":"Help Net Security reports X.Org fixed eight xorg-server and Xwayland flaws; update to xorg-server 21.1.26 or xwayland 24.1.15.","tags":["exploited","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/datadog-claims-cloud-highcritical-flaws-rose-fourfold-since-may/","title":"Datadog claims cloud high/critical flaws rose fourfold since May","url":"https://vulnpocalypse.dev/advisories/datadog-claims-cloud-highcritical-flaws-rose-fourfold-since-may/","date":"2026-11-10","summary":"Infosecurity Magazine reports Datadog claims median high/critical cloud workload flaws rose from four to 16; review long-lived keys and dependency","tags":["ai-tools","cloud","ai-tools","ci-cd","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/cisa-kev-adds-ibm-aspera-faspex-freeswitch-openssh-gpustack-flaws/","title":"CISA KEV adds IBM Aspera Faspex, FreeSWITCH, OpenSSH, GPUStack flaws","url":"https://vulnpocalypse.dev/advisories/cisa-kev-adds-ibm-aspera-faspex-freeswitch-openssh-gpustack-flaws/","date":"2026-11-10","summary":"CISA added four exploited flaws in GPUStack, FreeSWITCH, OpenSSH and IBM Aspera Faspex to KEV; check your versions and patch.","tags":["ai-tools","ai-tools","enterprise","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/torvalds-says-ai-patch-flood-may-be-peaking-the-register-reports/","title":"Torvalds says AI patch flood may be peaking, The Register reports","url":"https://vulnpocalypse.dev/advisories/torvalds-says-ai-patch-flood-may-be-peaking-the-register-reports/","date":"2026-11-09","summary":"The Register reports Linus Torvalds says Linux 7.4 rc2 hints the AI-driven patch flood may ease, so keep patching on your normal schedule.","tags":["ai-tools","open-source","ai-tools"]},{"id":"https://vulnpocalypse.dev/advisories/react-maintainers-report-critical-rce-flaw-in-react-server-components/","title":"React maintainers report critical RCE flaw in React Server Components","url":"https://vulnpocalypse.dev/advisories/react-maintainers-report-critical-rce-flaw-in-react-server-components/","date":"2026-11-09","summary":"React maintainers report a critical unauthenticated RCE flaw in three react-server-dom packages; upgrade to 19.0.9, 19.1.10, 19.2.9 or 19.3.1.","tags":["exploited","npm","nodejs","web","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/hacker-news-recap-reports-openssh-sshole-exploitation-attempts/","title":"Hacker News recap reports OpenSSH SSHole exploitation attempts","url":"https://vulnpocalypse.dev/advisories/hacker-news-recap-reports-openssh-sshole-exploitation-attempts/","date":"2026-11-09","summary":"The Hacker News reports exploitation attempts on OpenSSH flaw SSHole on musl systems without PAM, so check your hosts and patch.","tags":["exploited","open-source","network-edge","enterprise","web"]},{"id":"https://vulnpocalypse.dev/advisories/cpython-bug-enables-jinja-sandbox-escape-in-ai-inference-servers-runsybil-says/","title":"CPython bug enables Jinja sandbox escape in AI inference servers, RunSybil says","url":"https://vulnpocalypse.dev/advisories/cpython-bug-enables-jinja-sandbox-escape-in-ai-inference-servers-runsybil-says/","date":"2026-11-09","summary":"RunSybil reports a CPython bug it says lets a malicious model template escape the Jinja sandbox; treat untrusted model templates as code until patched.","tags":["ai-tools","ai-tools","open-source","cloud"]},{"id":"https://vulnpocalypse.dev/advisories/sonatype-reports-polinrider-loader-in-12-hijacked-npm-package-releases/","title":"Sonatype reports PolinRider loader in 12 hijacked npm package releases","url":"https://vulnpocalypse.dev/advisories/sonatype-reports-polinrider-loader-in-12-hijacked-npm-package-releases/","date":"2026-11-09","summary":"Sonatype reports concealed PolinRider loaders in 12 hijacked npm releases; check lockfiles and mirrors and remove the affected versions.","tags":["supply-chain","npm","nodejs","open-source","ci-cd"]},{"id":"https://vulnpocalypse.dev/advisories/btcpay-server-hot-wallet-thefts/","title":"BTCPay Server hot wallets drained on outdated self-hosted instances","url":"https://vulnpocalypse.dev/advisories/btcpay-server-hot-wallet-thefts/","date":"2026-11-09","summary":"Attackers drained hot wallets on internet-exposed BTCPay Server instances running 2.4.1 or older; update to 2.4.7 and move funds to a new wallet.","tags":["exploited","crypto","network-edge","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/linux-kernel-tcp-cve-2026-98432/","title":"Linux kernel CVE-2026-98432: IPv4 TCP handshake use-after-free, with an AI-built remote root exploit","url":"https://vulnpocalypse.dev/advisories/linux-kernel-tcp-cve-2026-98432/","date":"2026-11-09","summary":"A race in Linux's IPv4 TCP handshake, present since 4.4, allows remote code execution. Install a fixed kernel or drop IPv4 packets carrying IP options.","tags":["exploited","open-source","cloud","network-edge"]},{"id":"https://vulnpocalypse.dev/advisories/artex-agentic-ai-used-in-connectwise-supply-chain-attack-and-vapor-panda-espiona/","title":"ARTEX agentic AI used in ConnectWise supply chain attack and VAPOR PANDA espionage campaign","url":"https://vulnpocalypse.dev/advisories/artex-agentic-ai-used-in-connectwise-supply-chain-attack-and-vapor-panda-espiona/","date":"2026-11-09","summary":"China-aligned actors used the ARTEX agentic AI framework against ConnectWise customers and 200+ organizations, so review Microsoft 365 app access now.","tags":["supply-chain","ai-tools","cloud","enterprise","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/researcher-reports-pre-auth-rce-in-eclipse-mosquitto-websocket-listener/","title":"Researcher reports pre-auth RCE in Eclipse Mosquitto WebSocket listener","url":"https://vulnpocalypse.dev/advisories/researcher-reports-pre-auth-rce-in-eclipse-mosquitto-websocket-listener/","date":"2026-11-08","summary":"A researcher reports a pre-auth RCE in Eclipse Mosquitto 2.1.x WebSocket, and Home Assistant add-on users should update to 7.1.2 or later.","tags":["exploited","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/lexifina-global-law-repo-reports-drafting-errors-in-national-laws/","title":"Lexifina global-law repo reports drafting errors in national laws","url":"https://vulnpocalypse.dev/advisories/lexifina-global-law-repo-reports-drafting-errors-in-national-laws/","date":"2026-11-08","summary":"The lexifina/global-law repo reports legal drafting errors across 107 national law corpora; treat flags as research prompts, not legal advice.","tags":["exploited","open-source"]},{"id":"https://vulnpocalypse.dev/advisories/control-web-panel-cwp-cwpsrv-trojanized-with-cwpdoor-linux-backdoor-that-hides/","title":"Control Web Panel (CWP) cwpsrv trojanized with CWPdoor Linux backdoor that hides commands from logs","url":"https://vulnpocalypse.dev/advisories/control-web-panel-cwp-cwpsrv-trojanized-with-cwpdoor-linux-backdoor-that-hides/","date":"2026-11-08","summary":"A trojanized cwpsrv binary in Control Web Panel hides the CWPdoor Linux backdoor, so check CWP servers for the integrity helper socket now.","tags":["ecosystem","web","open-source"]}]}