https://vulnpocalypse.dev/feeds/Advisories for open-source maintainers and consumers: disclosure floods, patch backlogs and AI-generated reports.enThu, 12 Nov 2026 16:59:02 +0000https://vulnpocalypse.dev/advisories/github-issue-comment-injection-campaign/https://vulnpocalypse.dev/advisories/github-issue-comment-injection-campaign/Thu, 12 Nov 2026 12:00:00 +0000Hidden shell commands in GitHub issues, PRs and comments hit 61 repos, including Trivy and MLflow. Find workflows that put issue text into run steps.supply-chaingithub-actionsci-cdopen-sourcehttps://vulnpocalypse.dev/advisories/bufferzonecorp-go-rubygems-ci-stealer/https://vulnpocalypse.dev/advisories/bufferzonecorp-go-rubygems-ci-stealer/Thu, 12 Nov 2026 12:00:00 +0000BufferZoneCorp Go modules and knot-* gems stole SSH, cloud, npm, gh and kube credentials and tampered with GitHub Actions. Check go.mod and Gemfile.lock.supply-chaingithub-actionsci-cdopen-sourcehttps://vulnpocalypse.dev/advisories/palo-alto-networks-discloses-checkov-ssrf-flaw-cve-2026-0323/https://vulnpocalypse.dev/advisories/palo-alto-networks-discloses-checkov-ssrf-flaw-cve-2026-0323/Wed, 11 Nov 2026 12:00:00 +0000Palo Alto Networks says Checkov before 3.4.2 has an SSRF flaw, CVE-2026-0323; upgrade to 3.4.2 or later if external module downloads are on.exploitedcloudopen-sourcehttps://vulnpocalypse.dev/advisories/microsoft-reports-threat-actors-using-gsocket-for-persistent-linux-c2/https://vulnpocalypse.dev/advisories/microsoft-reports-threat-actors-using-gsocket-for-persistent-linux-c2/Wed, 11 Nov 2026 12:00:00 +0000Microsoft reports threat actors deploy GSocket on compromised Linux servers for persistent access; remove the client, not just patch the app.ecosystemwebendpointopen-sourcehttps://vulnpocalypse.dev/advisories/endor-labs-reports-openclaw-apply-patch-path-traversal-fixed-in-2026214/https://vulnpocalypse.dev/advisories/endor-labs-reports-openclaw-apply-patch-path-traversal-fixed-in-2026214/Wed, 11 Nov 2026 12:00:00 +0000Endor Labs reports a path traversal in OpenClaw apply_patch; the project advisory lists a fix in 2026.2.14, so upgrade openclaw.ai-toolsnpmnodejsai-toolsopen-sourcehttps://vulnpocalypse.dev/advisories/endor-labs-claims-its-ai-sast-found-26x-more-real-flaws-than-claude/https://vulnpocalypse.dev/advisories/endor-labs-claims-its-ai-sast-found-26x-more-real-flaws-than-claude/Wed, 11 Nov 2026 12:00:00 +0000Endor Labs claims its AI SAST found 192 real vulnerabilities in an 8-project benchmark; treat it as a vendor claim and test on your own code.ai-toolsai-toolsopen-sourcehttps://vulnpocalypse.dev/advisories/github-blog-reports-git-2561-fixes-six-security-flaws/https://vulnpocalypse.dev/advisories/github-blog-reports-git-2561-fixes-six-security-flaws/Wed, 11 Nov 2026 12:00:00 +0000The GitHub Blog says Git 2.56.1 and backports address six vulnerabilities, including code execution on recursive clone; update Git.exploitedopen-sourcehttps://vulnpocalypse.dev/advisories/gbhackers-reports-modsecurity-waf-upload-bypass-and-xml-flaw/https://vulnpocalypse.dev/advisories/gbhackers-reports-modsecurity-waf-upload-bypass-and-xml-flaw/Wed, 11 Nov 2026 12:00:00 +0000GBHackers reports two ModSecurity advisories, an upload filter bypass and an XML bug; set SecParseXmlIntoArgs Off and validate decoded filenames.exploitedopen-sourcewebhttps://vulnpocalypse.dev/advisories/ethersphere-bee-js-1330-and-swarm-desktop-0562-compromised/https://vulnpocalypse.dev/advisories/ethersphere-bee-js-1330-and-swarm-desktop-0562-compromised/Wed, 11 Nov 2026 12:00:00 +0000Malicious @ethersphere/bee-js 13.3.0 and Swarm Desktop 0.56.2 steal Swarm wallet files; check for them and rotate keys on any affected host.supply-chainnpmnodejsgithub-actionscryptoopen-sourcehttps://vulnpocalypse.dev/advisories/fake-github-security-tool-repos-spread-asyncrat-doctor-web-reports/https://vulnpocalypse.dev/advisories/fake-github-security-tool-repos-spread-asyncrat-doctor-web-reports/Wed, 11 Nov 2026 12:00:00 +0000Doctor Web reports fake GitHub security tool repos infected over 2,000 PCs; inspect build steps before running any cloned project.supply-chainopen-sourceendpointcryptohttps://vulnpocalypse.dev/advisories/claude-code-settingslocaljson-leaks-secrets-to-public-github-repos/https://vulnpocalypse.dev/advisories/claude-code-settingslocaljson-leaks-secrets-to-public-github-repos/Wed, 11 Nov 2026 12:00:00 +0000Claude Code can save approved commands with secrets in .claude/settings.local.json, found in public GitHub repos; rotate any credential it ever held.ai-toolsai-toolsopen-sourcehttps://vulnpocalypse.dev/advisories/openssh-alpine-musl-password-auth-bypass/https://vulnpocalypse.dev/advisories/openssh-alpine-musl-password-auth-bypass/Wed, 11 Nov 2026 12:00:00 +0000On Alpine and musl systems with sshd built without PAM, a locked account accepts any long password. Update openssh and restart sshd.exploitedopen-sourcecloudhttps://vulnpocalypse.dev/advisories/openai-gpt6-cyber-948-linux-flaws/https://vulnpocalypse.dev/advisories/openai-gpt6-cyber-948-linux-flaws/Wed, 11 Nov 2026 12:00:00 +0000OpenAI's GPT-6 Cyber built 948 working Linux kernel root exploits and reported 81 high-severity Firefox flaws, all disclosed for patching.ai-toolsai-toolsopen-sourceendpointhttps://vulnpocalypse.dev/advisories/debian-and-ubuntu-apt-flaw-cve-2026-109518-lets-a-mitm-swap-verified-packages-an/https://vulnpocalypse.dev/advisories/debian-and-ubuntu-apt-flaw-cve-2026-109518-lets-a-mitm-swap-verified-packages-an/Wed, 11 Nov 2026 12:00:00 +0000A flaw in APT, tracked as CVE-2026-109518, lets a network attacker swap a verified package for a malicious one and run code as root on Debian and Ubuntu.exploitedopen-sourcehttps://vulnpocalypse.dev/advisories/critical-rails-active-storage-flaw-lets-crafted-imagemagick-uploads-write-server/https://vulnpocalypse.dev/advisories/critical-rails-active-storage-flaw-lets-crafted-imagemagick-uploads-write-server/Wed, 11 Nov 2026 12:00:00 +0000A critical Rails Active Storage flaw lets unauthenticated uploads write files through ImageMagick, fixed in activestorage 8.1.4.1 and 8.0.5.2.exploitedwebopen-sourcehttps://vulnpocalypse.dev/advisories/artex-ai-framework-exposed-korean-banks/https://vulnpocalypse.dev/advisories/artex-ai-framework-exposed-korean-banks/Wed, 11 Nov 2026 12:00:00 +0000Operators of the China-made ARTEX AI pentest framework left servers open, exposing Claude Code and DeepSeek-driven tooling tied to breaches at seven South.ai-toolsai-toolsenterprisecloudopen-sourcehttps://vulnpocalypse.dev/advisories/solanacry-fake-solana-github-repo-lures-ai-coding-agents-hackread-reports/https://vulnpocalypse.dev/advisories/solanacry-fake-solana-github-repo-lures-ai-coding-agents-hackread-reports/Wed, 11 Nov 2026 12:00:00 +0000Hackread reports a fake GitHub Solana starter kit tells AI agents to install NetSupport RAT; review commands before agents run them.supply-chainai-toolsopen-sourcecryptoendpointhttps://vulnpocalypse.dev/advisories/cursor-claude-code-extension-backdoor/https://vulnpocalypse.dev/advisories/cursor-claude-code-extension-backdoor/Wed, 11 Nov 2026 12:00:00 +0000Fake Claude Code 2.1.312 and 2.1.313 on Cursor's marketplace added an attacker SSH key and reverse tunnel. Check authorized_keys for svc-telemetry.supply-chainai-toolsendpointopen-sourcehttps://vulnpocalypse.dev/advisories/android-sms-of-death-wap-push/https://vulnpocalypse.dev/advisories/android-sms-of-death-wap-push/Wed, 11 Nov 2026 12:00:00 +0000One crafted WAP push SMS crashes com.android.phone on Android 12 to 16, dropping calls. Install the October 2026 patch; Android 12 and 13 get no fix.exploitedendpointopen-sourcehttps://vulnpocalypse.dev/advisories/drupal-commerce-cve-2026-118539/https://vulnpocalypse.dev/advisories/drupal-commerce-cve-2026-118539/Wed, 11 Nov 2026 12:00:00 +0000An exploited access bypass in Drupal Commerce Core can cost store owners money. Update to Commerce 3.3.13 or 8.x-2.41 and audit recent orders.exploitedphpwebopen-sourcehttps://vulnpocalypse.dev/advisories/anthropic-ai-model-chained-flaws-into-chrome-safari-android-windows-and-linux-ex/https://vulnpocalypse.dev/advisories/anthropic-ai-model-chained-flaws-into-chrome-safari-android-windows-and-linux-ex/Wed, 11 Nov 2026 12:00:00 +0000Anthropic says an unreleased model chained flaws into five working exploits for Chrome, Safari, Android, Windows and Linux, all reported and patched.ai-toolsai-toolswebendpointopen-sourcehttps://vulnpocalypse.dev/advisories/growi-jvn-discloses-three-authorization-flaws-up-to-v806-fixed-in-v807/https://vulnpocalypse.dev/advisories/growi-jvn-discloses-three-authorization-flaws-up-to-v806-fixed-in-v807/Wed, 11 Nov 2026 12:00:00 +0000JVN discloses three authorization flaws in GROWI up to v8.0.6 that let users read or alter pages they should not, so upgrade GROWI to v8.0.7.exploitedwebopen-sourcehttps://vulnpocalypse.dev/advisories/popcorn-time-fork-updater-left-devices-open-to-hijacking-malwarebytes-reports/https://vulnpocalypse.dev/advisories/popcorn-time-fork-updater-left-devices-open-to-hijacking-malwarebytes-reports/Wed, 11 Nov 2026 12:00:00 +0000Malwarebytes reports an abandoned Popcorn Time fork updater could run attacker code, so remove Popcorn Time or Time4Popcorn from old devices.exploitedendpointopen-sourcehttps://vulnpocalypse.dev/advisories/node2shell-brotli-cve-2026-111497/https://vulnpocalypse.dev/advisories/node2shell-brotli-cve-2026-111497/Wed, 11 Nov 2026 12:00:00 +0000CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder. Crafted compressed data can crash or run code. Patch Node.js, Brotli, Bun and more.exploitednodejsopen-sourcehttps://vulnpocalypse.dev/advisories/edk2-pxe-rce-cve-2026-97631/https://vulnpocalypse.dev/advisories/edk2-pxe-rce-cve-2026-97631/Wed, 11 Nov 2026 12:00:00 +0000An EDK II PXE driver overflow can run code before the OS and Secure Boot. No stable fix yet: disable PXE where unused and isolate boot networks.exploitedopen-sourcecloudhttps://vulnpocalypse.dev/advisories/litellm-11070-on-pypi-and-docker-was-backdoored-with-a-credential-stealer-and-re/https://vulnpocalypse.dev/advisories/litellm-11070-on-pypi-and-docker-was-backdoored-with-a-credential-stealer-and-re/Wed, 11 Nov 2026 12:00:00 +0000LiteLLM 1.107.0 on PyPI and official Docker images ran a credential stealer on every Python start; roll back to 1.106.2 and rotate all reachable secrets.supply-chainpypiai-toolsopen-sourceci-cdcloudhttps://vulnpocalypse.dev/advisories/emudhra-intermediate-ca-compromise/https://vulnpocalypse.dev/advisories/emudhra-intermediate-ca-compromise/Wed, 11 Nov 2026 12:00:00 +0000Eight eMudhra intermediate CA keys were guessable. Browsers block them; update CA bundles and runtimes, and replace TLS certs under emSign ECC Root CA - G3.ecosystemendpointnodejspypiopen-sourcehttps://vulnpocalypse.dev/advisories/artex-ai-pentest-framework-abused-in-data-theft-from-south-korean-banks/https://vulnpocalypse.dev/advisories/artex-ai-pentest-framework-abused-in-data-theft-from-south-korean-banks/Wed, 11 Nov 2026 12:00:00 +0000A suspected Chinese-speaking, financially motivated actor used the ARTEX agentic pentest tool to steal data from South Korean financial firms.ai-toolsai-toolsopen-sourcewebenterprisehttps://vulnpocalypse.dev/advisories/glasswing-disclosure-wave/https://vulnpocalypse.dev/advisories/glasswing-disclosure-wave/Wed, 11 Nov 2026 12:00:00 +0000Of 6,157 Glasswing vulnerabilities disclosed to open-source maintainers, about 8% were patched by October 2026. Expect a long tail of dependency fixes.ecosystemopen-sourcehttps://vulnpocalypse.dev/advisories/rejetto-hfs-cve-2026-61500/https://vulnpocalypse.dev/advisories/rejetto-hfs-cve-2026-61500/Wed, 11 Nov 2026 12:00:00 +0000A predictable session key in HFS 3.0.0 to 3.2.0, found with Claude Mythos, lets attackers forge an admin login and run code. Update to 3.2.1 or later.exploitednodejsnpmopen-sourcehttps://vulnpocalypse.dev/advisories/ai-found-vulnerabilities-exploitation-rate/https://vulnpocalypse.dev/advisories/ai-found-vulnerabilities-exploitation-rate/Wed, 11 Nov 2026 12:00:00 +0000VulnCheck found 1.3% of AI-found vulnerabilities exploited in 1H 2026, the same as all bugs. Patch AI-found CVEs by exposure, not by how they were found.ai-toolsai-toolsvuln-dataopen-sourcehttps://vulnpocalypse.dev/advisories/nvd-stops-enriching-most-cves/https://vulnpocalypse.dev/advisories/nvd-stops-enriching-most-cves/Wed, 11 Nov 2026 12:00:00 +0000Since 15 April 2026 NIST no longer adds severity scores or product data to most new CVEs. Tools that match on NVD data miss or misjudge risk.ecosystemvuln-dataopen-sourcehttps://vulnpocalypse.dev/advisories/curl-ends-bug-bounty-ai-slop/https://vulnpocalypse.dev/advisories/curl-ends-bug-bounty-ai-slop/Wed, 11 Nov 2026 12:00:00 +0000curl closed its HackerOne bug bounty on 31 January 2026 to stop paying for invented AI reports. How maintainers can filter the flood without missing real bugs.ecosystemopen-sourcehttps://vulnpocalypse.dev/advisories/vulncheck-says-anthropic-glasswing-cves-are-few-fixes-lag/https://vulnpocalypse.dev/advisories/vulncheck-says-anthropic-glasswing-cves-are-few-fixes-lag/Tue, 10 Nov 2026 12:00:00 +0000VulnCheck says 442 CVEs trace to Anthropic's Glasswing, 2 exploited; check those two CVEs and treat scanner reports as unverified.ai-toolsai-toolsopen-sourcevuln-datahttps://vulnpocalypse.dev/advisories/researcher-says-100-flaws-found-in-uk-government-public-code-per-wired/https://vulnpocalypse.dev/advisories/researcher-says-100-flaws-found-in-uk-government-public-code-per-wired/Tue, 10 Nov 2026 12:00:00 +0000Wired reports a researcher says he found over 100 vulnerabilities in public UK government code; check your repos for committed secrets.ai-toolsopen-sourcecloudai-toolsenterprisehttps://vulnpocalypse.dev/advisories/near-ai-breached-via-sglang-rce-flaw-18-agents-and-100-users-hit/https://vulnpocalypse.dev/advisories/near-ai-breached-via-sglang-rce-flaw-18-agents-and-100-users-hit/Tue, 10 Nov 2026 12:00:00 +0000An SGLang RCE flaw let an attacker into NEAR AI systems; users should check for direct mail from security@near.ai and be wary of unsolicited messages.ai-toolsai-toolscloudopen-sourcehttps://vulnpocalypse.dev/advisories/help-net-security-reports-xorg-fixes-eight-x-server-and-xwayland-flaws/https://vulnpocalypse.dev/advisories/help-net-security-reports-xorg-fixes-eight-x-server-and-xwayland-flaws/Tue, 10 Nov 2026 12:00:00 +0000Help Net Security reports X.Org fixed eight xorg-server and Xwayland flaws; update to xorg-server 21.1.26 or xwayland 24.1.15.exploitedopen-sourcehttps://vulnpocalypse.dev/advisories/datadog-claims-cloud-highcritical-flaws-rose-fourfold-since-may/https://vulnpocalypse.dev/advisories/datadog-claims-cloud-highcritical-flaws-rose-fourfold-since-may/Tue, 10 Nov 2026 12:00:00 +0000Infosecurity Magazine reports Datadog claims median high/critical cloud workload flaws rose from four to 16; review long-lived keys and dependencyai-toolscloudai-toolsci-cdopen-sourcehttps://vulnpocalypse.dev/advisories/cisa-kev-adds-ibm-aspera-faspex-freeswitch-openssh-gpustack-flaws/https://vulnpocalypse.dev/advisories/cisa-kev-adds-ibm-aspera-faspex-freeswitch-openssh-gpustack-flaws/Tue, 10 Nov 2026 12:00:00 +0000CISA added four exploited flaws in GPUStack, FreeSWITCH, OpenSSH and IBM Aspera Faspex to KEV; check your versions and patch.ai-toolsai-toolsenterpriseopen-sourcehttps://vulnpocalypse.dev/advisories/torvalds-says-ai-patch-flood-may-be-peaking-the-register-reports/https://vulnpocalypse.dev/advisories/torvalds-says-ai-patch-flood-may-be-peaking-the-register-reports/Mon, 09 Nov 2026 12:00:00 +0000The Register reports Linus Torvalds says Linux 7.4 rc2 hints the AI-driven patch flood may ease, so keep patching on your normal schedule.ai-toolsopen-sourceai-toolshttps://vulnpocalypse.dev/advisories/react-maintainers-report-critical-rce-flaw-in-react-server-components/https://vulnpocalypse.dev/advisories/react-maintainers-report-critical-rce-flaw-in-react-server-components/Mon, 09 Nov 2026 12:00:00 +0000React maintainers report a critical unauthenticated RCE flaw in three react-server-dom packages; upgrade to 19.0.9, 19.1.10, 19.2.9 or 19.3.1.exploitednpmnodejswebopen-sourcehttps://vulnpocalypse.dev/advisories/hacker-news-recap-reports-openssh-sshole-exploitation-attempts/https://vulnpocalypse.dev/advisories/hacker-news-recap-reports-openssh-sshole-exploitation-attempts/Mon, 09 Nov 2026 12:00:00 +0000The Hacker News reports exploitation attempts on OpenSSH flaw SSHole on musl systems without PAM, so check your hosts and patch.exploitedopen-sourcenetwork-edgeenterprisewebhttps://vulnpocalypse.dev/advisories/cpython-bug-enables-jinja-sandbox-escape-in-ai-inference-servers-runsybil-says/https://vulnpocalypse.dev/advisories/cpython-bug-enables-jinja-sandbox-escape-in-ai-inference-servers-runsybil-says/Mon, 09 Nov 2026 12:00:00 +0000RunSybil reports a CPython bug it says lets a malicious model template escape the Jinja sandbox; treat untrusted model templates as code until patched.ai-toolsai-toolsopen-sourcecloudhttps://vulnpocalypse.dev/advisories/sonatype-reports-polinrider-loader-in-12-hijacked-npm-package-releases/https://vulnpocalypse.dev/advisories/sonatype-reports-polinrider-loader-in-12-hijacked-npm-package-releases/Mon, 09 Nov 2026 12:00:00 +0000Sonatype reports concealed PolinRider loaders in 12 hijacked npm releases; check lockfiles and mirrors and remove the affected versions.supply-chainnpmnodejsopen-sourceci-cdhttps://vulnpocalypse.dev/advisories/btcpay-server-hot-wallet-thefts/https://vulnpocalypse.dev/advisories/btcpay-server-hot-wallet-thefts/Mon, 09 Nov 2026 12:00:00 +0000Attackers drained hot wallets on internet-exposed BTCPay Server instances running 2.4.1 or older; update to 2.4.7 and move funds to a new wallet.exploitedcryptonetwork-edgeopen-sourcehttps://vulnpocalypse.dev/advisories/linux-kernel-tcp-cve-2026-98432/https://vulnpocalypse.dev/advisories/linux-kernel-tcp-cve-2026-98432/Mon, 09 Nov 2026 12:00:00 +0000A race in Linux's IPv4 TCP handshake, present since 4.4, allows remote code execution. Install a fixed kernel or drop IPv4 packets carrying IP options.exploitedopen-sourcecloudnetwork-edgehttps://vulnpocalypse.dev/advisories/artex-agentic-ai-used-in-connectwise-supply-chain-attack-and-vapor-panda-espiona/https://vulnpocalypse.dev/advisories/artex-agentic-ai-used-in-connectwise-supply-chain-attack-and-vapor-panda-espiona/Mon, 09 Nov 2026 12:00:00 +0000China-aligned actors used the ARTEX agentic AI framework against ConnectWise customers and 200+ organizations, so review Microsoft 365 app access now.supply-chainai-toolscloudenterpriseopen-sourcehttps://vulnpocalypse.dev/advisories/researcher-reports-pre-auth-rce-in-eclipse-mosquitto-websocket-listener/https://vulnpocalypse.dev/advisories/researcher-reports-pre-auth-rce-in-eclipse-mosquitto-websocket-listener/Sun, 08 Nov 2026 12:00:00 +0000A researcher reports a pre-auth RCE in Eclipse Mosquitto 2.1.x WebSocket, and Home Assistant add-on users should update to 7.1.2 or later.exploitedopen-sourcehttps://vulnpocalypse.dev/advisories/lexifina-global-law-repo-reports-drafting-errors-in-national-laws/https://vulnpocalypse.dev/advisories/lexifina-global-law-repo-reports-drafting-errors-in-national-laws/Sun, 08 Nov 2026 12:00:00 +0000The lexifina/global-law repo reports legal drafting errors across 107 national law corpora; treat flags as research prompts, not legal advice.exploitedopen-sourcehttps://vulnpocalypse.dev/advisories/control-web-panel-cwp-cwpsrv-trojanized-with-cwpdoor-linux-backdoor-that-hides/https://vulnpocalypse.dev/advisories/control-web-panel-cwp-cwpsrv-trojanized-with-cwpdoor-linux-backdoor-that-hides/Sun, 08 Nov 2026 12:00:00 +0000A trojanized cwpsrv binary in Control Web Panel hides the CWPdoor Linux backdoor, so check CWP servers for the integrity helper socket now.ecosystemwebopen-source