{"schema":"threatline.brief/1","generated_at":"2026-10-24T10:48:42.330819Z","note":"Per UTC day: additions to CISA KEV, exploitation reported before CISA (two or more reports), supply chain compromises, and critical flaws (CVSS 9+) in products that have a KEV entry.","days":[{"date":"2026-10-24","partial":true,"title":"Saturday 24 Oct 2026","headline":"Nothing that meets the bar.","counts":{"kev":0,"exploited":0,"supply":0,"critical":0},"kev":[],"exploited":[],"supply":[],"critical":[]},{"date":"2026-10-23","partial":false,"title":"Friday 23 Oct 2026","headline":"2 added to CISA's known exploited list, 1 reported exploited and not on CISA's list, 31 supply chain compromises.","counts":{"kev":2,"exploited":1,"supply":31,"critical":0},"kev":[{"id":"CVE-2026-110447","title":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability","vendor":"Collabora","product":"Collabora Online – Built-in CODE Server","severity":"Critical","cvss":9.2,"epss":0.01225,"kev_added":"2026-10-23","kev_due":"2026-10-26","triage":true,"fixed":["26.4.303"]},{"id":"CVE-2026-114625","title":"Arista VeloCloud Orchestrator SQL Injection Vulnerability","vendor":"Arista","product":"VeloCloud Orchestrator","severity":"Critical","cvss":9.9,"epss":0.00555,"kev_added":"2026-10-23","kev_due":"2026-10-26","triage":true,"fixed":["5.2.3.18","6.1.3.10","6.4.2.12"]}],"exploited":[{"id":"CVE-2026-106173","title":"A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially cra","vendor":"Fortinet","product":"FortiSIEM","severity":"Critical","cvss":9.4,"epss":0.00459,"kev_added":null,"kev_due":null,"fixed":[],"first":{"at":"2026-10-23T16:06:25.746340Z","source":"Bluesky: exploited in the wild","url":"https://bsky.app/profile/cyfar.ca/post/3mykkos6r2t2w"},"outlets":4,"claims":1,"waf":[]}],"supply":[{"id":"litellm-1.107.0-2026-10","title":"LiteLLM 1.107.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"litellm","versions":["1.107.0"]}],"vendor":"BerriAI","product":"LiteLLM"},{"id":"MAL-2026-18205","title":"@tekmidian/pai 1.0.9, 1.0.8, 1.0.10 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@tekmidian/pai","versions":["1.0.9","1.0.8","1.0.10"]}],"vendor":null,"product":null},{"id":"MAL-2026-18218","title":"qowa 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"qowa","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18219","title":"onsokets 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"onsokets","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18220","title":"skillward 0.1.1, 0.1.2 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"skillward","versions":["0.1.1","0.1.2"]}],"vendor":null,"product":null},{"id":"MAL-2026-18221","title":"kestreljob 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"kestreljob","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18222","title":"badgertask 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"badgertask","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18223","title":"brambletask 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"brambletask","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18224","title":"brookworker 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"brookworker","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18225","title":"cobbleload 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"cobbleload","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18226","title":"ferretqueue 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"ferretqueue","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18227","title":"flintqueue 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"flintqueue","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18228","title":"jobwharf 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"jobwharf","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18229","title":"juniperrun 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"juniperrun","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18230","title":"larchworker 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"larchworker","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18231","title":"loadferry 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"loadferry","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18232","title":"marshrunner 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"marshrunner","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18233","title":"otterload 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"otterload","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18234","title":"reedworker 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"reedworker","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18235","title":"runpier 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"runpier","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18236","title":"sedgehaul 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"sedgehaul","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18237","title":"slatejob 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"slatejob","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18238","title":"taskquay 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"taskquay","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18239","title":"thistlerun 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"thistlerun","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18240","title":"thornqueue 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"thornqueue","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18241","title":"workslip 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"workslip","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18242","title":"sitecard 0.1.0, 0.1.1, 0.1.2 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"sitecard","versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.6","0.1.7","0.1.8","0.1.9","0.1.10","0.1.11","0.1.12","0.1.13","0.1.14"]}],"vendor":null,"product":null},{"id":"MAL-2026-18243","title":"@k18k/entrypoint-sdk-darwin-arm64 0.2.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@k18k/entrypoint-sdk-darwin-arm64","versions":["0.2.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18244","title":"@k18k/entrypoint-sdk-darwin-x64 0.2.0, 0.2.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@k18k/entrypoint-sdk-darwin-x64","versions":["0.2.0","0.2.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18245","title":"@k18k/entrypoint-sdk-linux-x64 0.2.0, 0.2.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@k18k/entrypoint-sdk-linux-x64","versions":["0.2.0","0.2.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18246","title":"orqiva-runtime-win32-x64 0.1.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"orqiva-runtime-win32-x64","versions":["0.1.0"]}],"vendor":null,"product":null}],"critical":[]},{"date":"2026-10-22","partial":false,"title":"Thursday 22 Oct 2026","headline":"1 reported exploited and not on CISA's list, 43 supply chain compromises, 2 critical flaws in products attackers have targeted.","counts":{"kev":0,"exploited":1,"supply":43,"critical":2},"kev":[],"exploited":[{"id":"CVE-2026-114625","title":"Arista VeloCloud Orchestrator SQL Injection Vulnerability","vendor":"Arista","product":"VeloCloud Orchestrator","severity":"Critical","cvss":9.9,"epss":0.00555,"kev_added":"2026-10-23","kev_due":"2026-10-26","triage":true,"fixed":["5.2.3.18","6.1.3.10","6.4.2.12"],"first":{"at":"2026-10-22T15:25:36Z","source":"Bluesky: exploited in the wild","url":"https://bsky.app/profile/securityonline.bsky.social/post/3myhxwvbcy32s"},"outlets":5,"claims":6,"zero_day":true,"waf":[]}],"supply":[{"id":"MAL-2026-18152","title":"acousticpack 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"acousticpack","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18153","title":"hookgantry 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"hookgantry","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18154","title":"pipegrip 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"pipegrip","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18155","title":"acoustichub 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"acoustichub","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18156","title":"asrdock 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"asrdock","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18157","title":"asrloom 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"asrloom","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18158","title":"audiokit 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"audiokit","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18159","title":"benchbridge 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"benchbridge","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18160","title":"benchworks 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"benchworks","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18161","title":"evalstream 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"evalstream","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18162","title":"modelworks 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"modelworks","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18163","title":"phonemeforge 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"phonemeforge","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18164","title":"phonemeprobe 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"phonemeprobe","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18165","title":"soundsocket 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"soundsocket","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18166","title":"speakbench 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"speakbench","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18167","title":"speaksocket 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"speaksocket","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18168","title":"speechprobe 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"speechprobe","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18169","title":"ttsdock 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"ttsdock","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18170","title":"ttsflow 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"ttsflow","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18171","title":"ttsprobe 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"ttsprobe","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18172","title":"ttsweaver 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"ttsweaver","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18173","title":"vocabbench 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"vocabbench","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18174","title":"vocabblend 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"vocabblend","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18175","title":"voicekit 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"voicekit","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18176","title":"voxweaver 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"voxweaver","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18183","title":"@conduitops/logview-archive 1.0.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@conduitops/logview-archive","versions":["1.0.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18184","title":"formatting-subtitles 1.0.2 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"formatting-subtitles","versions":["1.0.2"]}],"vendor":null,"product":null},{"id":"MAL-2026-18185","title":"log-rotate-testmetest 1.0.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"log-rotate-testmetest","versions":["1.0.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18186","title":"net-codec-testmetest 1.0.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"net-codec-testmetest","versions":["1.0.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18187","title":"simplewave 0.0.2 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"simplewave","versions":["0.0.2"]}],"vendor":null,"product":null},{"id":"MAL-2026-18188","title":"1h1 1.0.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"1h1","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18189","title":"aanthropic 1.0.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"aanthropic","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18190","title":"@liauto/darwin-x64 0.1.1-b3 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@liauto/darwin-x64","versions":["0.1.1-b3"]}],"vendor":null,"product":null},{"id":"MAL-2026-18191","title":"@pkgship/frpc-darwin-amd64 0.71.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@pkgship/frpc-darwin-amd64","versions":["0.71.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18192","title":"agentic-awesome-skills 19.0.0, 19.9.0, 19.6.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"agentic-awesome-skills","versions":["19.0.0","19.9.0","19.6.0","18.12.0","18.9.0","18.11.0","19.4.0","19.10.1","18.14.0","18.13.0","19.0.1","18.10.0","19.2.0","19.7.0","19.1.0","19.3.0","19.5.0","19.12.1","19.13.0","19.12.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18194","title":"@lumen-labs-dev/whisper-node 0.5.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@lumen-labs-dev/whisper-node","versions":["0.5.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18195","title":"darknode-cli 2.46.2, 2.46.1, 2.46.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"darknode-cli","versions":["2.46.2","2.46.1","2.46.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18197","title":"x402-prompt-injection-scan 0.1.4 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"x402-prompt-injection-scan","versions":["0.1.4"]}],"vendor":null,"product":null},{"id":"MAL-2026-18198","title":"@pkgship/frpc-linux-amd64 0.71.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@pkgship/frpc-linux-amd64","versions":["0.71.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18199","title":"@pkgship/frps-linux-amd64 0.71.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@pkgship/frps-linux-amd64","versions":["0.71.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18200","title":"@seggy116/next-diff 0.3.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@seggy116/next-diff","versions":["0.3.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18203","title":"journey-teste-shellhello 0.2.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"journey-teste-shellhello","versions":["0.2.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18204","title":"@factiii/runner 0.28.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@factiii/runner","versions":["0.28.0"]}],"vendor":null,"product":null}],"critical":[{"id":"CVE-2026-110264","title":"Integer Overflow or Wraparound in GitLab","vendor":"GitLab","product":"GitLab","severity":"Critical","cvss":10,"epss":0.00505,"kev_added":null,"kev_due":null,"fixed":["18.11.13","19.0.10","19.1.9"]},{"id":"CVE-2026-114612","title":"LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key","vendor":"BerriAI","product":"litellm","severity":"Critical","cvss":9.9,"epss":0.00235,"kev_added":null,"kev_due":null,"fixed":["1.100.4","1.101.3","1.102.2"]}]},{"date":"2026-10-21","partial":false,"title":"Wednesday 21 Oct 2026","headline":"2 reported exploited and not on CISA's list, 35 supply chain compromises, 1 critical flaw in products attackers have targeted.","counts":{"kev":0,"exploited":2,"supply":35,"critical":1},"kev":[],"exploited":[{"id":"CVE-2026-109618","title":"PHP: RCE via OOM corruption","vendor":"PHP Group","product":"PHP","severity":"Critical","cvss":9.2,"epss":0.1162,"kev_added":null,"kev_due":null,"fixed":["8.2.35","8.3.36","8.4.27"],"first":{"at":"2026-10-21T01:54:00Z","source":"Aikido","url":"https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell"},"outlets":25,"claims":10,"zero_day":true,"waf":["Cloudflare WAF"]},{"id":"CVE-2026-109619","title":"PHP: RCE via stale global state","vendor":"PHP Group","product":"PHP","severity":"Critical","cvss":9.2,"epss":0.05991,"kev_added":null,"kev_due":null,"fixed":["8.2.35","8.3.36","8.4.27"],"first":{"at":"2026-10-21T01:54:00Z","source":"Aikido","url":"https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell"},"outlets":23,"claims":10,"zero_day":true,"waf":["Cloudflare WAF"]}],"supply":[{"id":"connectwise-cloud-backup-2026-10","title":"ConnectWise Cloud Backup apps abused to reach Microsoft 365 tenants","kind":"service","packages":[],"vendor":"ConnectWise","product":"Cloud Backup"},{"id":"MAL-2026-18122","title":"moveworks-capi-starter 0.0.0, 0.2.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"moveworks-capi-starter","versions":["0.0.0","0.2.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18124","title":"journey-test-helloshell 0.2.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"journey-test-helloshell","versions":["0.2.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18126","title":"zzhelloworld_socktest 0.1.9, 0.1.5, 0.1.6 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"zzhelloworld_socktest","versions":["0.1.9","0.1.5","0.1.6","0.2.0","0.1.7","0.2.1","0.1.8"]}],"vendor":null,"product":null},{"id":"MAL-2026-18127","title":"@sudobility/indexer_client 0.0.146 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@sudobility/indexer_client","versions":["0.0.146"]}],"vendor":null,"product":null},{"id":"MAL-2026-18128","title":"@sudobility/shaperouter_client 0.0.14 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@sudobility/shaperouter_client","versions":["0.0.14"]}],"vendor":null,"product":null},{"id":"MAL-2026-18129","title":"@sudobility/testomniac_client 0.0.131 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@sudobility/testomniac_client","versions":["0.0.131"]}],"vendor":null,"product":null},{"id":"MAL-2026-18130","title":"@sudobility/wildduck_client 2.3.102 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@sudobility/wildduck_client","versions":["2.3.102"]}],"vendor":null,"product":null},{"id":"MAL-2026-18131","title":"iterquarry 2.1.1, 2.1.2, 2.1.3 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"iterquarry","versions":["2.1.1","2.1.2","2.1.3","2.1.4","2.2.0","2.2.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18132","title":"libseal 1.1.0, 1.1.1, 1.1.2 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"libseal","versions":["1.1.0","1.1.1","1.1.2","1.1.3"]}],"vendor":null,"product":null},{"id":"MAL-2026-18133","title":"journey-test-hellospy 0.1.1 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"journey-test-hellospy","versions":["0.1.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18134","title":"aurenatts 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"aurenatts","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18135","title":"batchspar 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"batchspar","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18136","title":"brummatts 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"brummatts","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18137","title":"codecraze 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"codecraze","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18138","title":"crenelatts 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"crenelatts","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18139","title":"dictanovaasr 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"dictanovaasr","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18140","title":"grommatts 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"grommatts","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18141","title":"melcuratts 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"melcuratts","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18142","title":"orchestril 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"orchestril","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18143","title":"phonoviatts 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"phonoviatts","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18144","title":"prosodinetts 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"prosodinetts","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18145","title":"quillonatts 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"quillonatts","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18146","title":"shellgrip 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"shellgrip","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18147","title":"solivoxtts 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"solivoxtts","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18148","title":"tessivatts 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"tessivatts","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18149","title":"vellutts 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"vellutts","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18150","title":"voxilaratts 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"voxilaratts","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18151","title":"zennittts 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"zennittts","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18177","title":"data-pipeline-testmetest 2.0.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"data-pipeline-testmetest","versions":["2.0.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18178","title":"event-emitter-testmetest 1.0.6, 1.0.7, 4.1.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"event-emitter-testmetest","versions":["1.0.6","1.0.7","4.1.0","5.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18179","title":"log-sink-testmetest 1.0.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"log-sink-testmetest","versions":["1.0.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18180","title":"pixel-map-testmetest 0.0.1, 0.0.2, 0.0.3 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"pixel-map-testmetest","versions":["0.0.1","0.0.2","0.0.3"]}],"vendor":null,"product":null},{"id":"MAL-2026-18181","title":"test-brotli-testmetest 1.0.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"test-brotli-testmetest","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18182","title":"test-brotli2-testmetest 1.0.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"test-brotli2-testmetest","versions":["1.0.0"]}],"vendor":null,"product":null}],"critical":[{"id":"CVE-2026-89035","title":"MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass","vendor":"MikroTik","product":"RouterOS","severity":"Critical","cvss":9.1,"epss":0.00274,"kev_added":null,"kev_due":null,"fixed":[]}]},{"date":"2026-10-20","partial":false,"title":"Tuesday 20 Oct 2026","headline":"6 added to CISA's known exploited list, 29 supply chain compromises, 8 critical flaws in products attackers have targeted.","counts":{"kev":6,"exploited":0,"supply":29,"critical":8},"kev":[{"id":"CVE-2026-106931","title":"EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability","vendor":"EG Secure Solutions","product":"SiteGuard Server Edition","severity":"High","cvss":7.8,"epss":0.0117,"kev_added":"2026-10-20","kev_due":"2026-10-23","triage":true,"fixed":[]},{"id":"CVE-2026-96656","title":"Plex Media Server External Control of File Name or Path Vulnerability","vendor":"Plex","product":"Media Server","severity":"High","cvss":8.6,"epss":0.00816,"kev_added":"2026-10-20","kev_due":"2026-10-23","triage":true,"fixed":["1.43.3.10861"]},{"id":"CVE-2026-96654","title":"Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability","vendor":"Plex","product":"Media Server","severity":"Medium","cvss":6.9,"epss":0.00465,"kev_added":"2026-10-20","kev_due":"2026-10-23","fixed":["1.43.3.10861"]},{"id":"CVE-2026-96652","title":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","vendor":"Plex","product":"Media Server","severity":"Medium","cvss":4.3,"epss":0.00455,"kev_added":"2026-10-20","kev_due":"2026-11-03","fixed":["1.43.3.10861"]},{"id":"CVE-2026-96655","title":"Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability","vendor":"Plex","product":"Media Server","severity":"Medium","cvss":4.3,"epss":0.00455,"kev_added":"2026-10-20","kev_due":"2026-11-03","fixed":["1.43.3.10861"]},{"id":"CVE-2026-110936","title":"Siemens Software Center Uncontrolled Search Path Element Vulnerability","vendor":"Siemens","product":"Software Center","severity":"Medium","cvss":6.7,"epss":0.00238,"kev_added":"2026-10-20","kev_due":"2026-11-03","fixed":[]}],"exploited":[],"supply":[{"id":"MAL-2026-18061","title":"ccl-global-shopping 99.9.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"ccl-global-shopping","versions":["99.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18062","title":"sc-wizard 99.9.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"sc-wizard","versions":["99.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18063","title":"fanarena-common 99.9.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"fanarena-common","versions":["99.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18064","title":"sc-announcer 99.9.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"sc-announcer","versions":["99.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18091","title":"@platform-services/hrm-mfe-core 99.9.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@platform-services/hrm-mfe-core","versions":["99.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18092","title":"test-workalendar-internal 0.0.1, 0.0.2, 0.0.3 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"test-workalendar-internal","versions":["0.0.1","0.0.2","0.0.3"]}],"vendor":null,"product":null},{"id":"MAL-2026-18093","title":"workcalender 17.1.0.dev0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"workcalender","versions":["17.1.0.dev0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18094","title":"pafex 2.3 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"pafex","versions":["2.3"]}],"vendor":null,"product":null},{"id":"MAL-2026-18095","title":"resion 22.0.1 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"resion","versions":["22.0.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18096","title":"workalender 17.1.0.dev0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"workalender","versions":["17.1.0.dev0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18097","title":"research-probe-6150c1c915 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"research-probe-6150c1c915","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18098","title":"security-research-startup-snapshot-810764b303 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"security-research-startup-snapshot-810764b303","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18101","title":"semmver 1.0.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"semmver","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18102","title":"semveer 1.0.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"semveer","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18103","title":"semverr 1.0.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"semverr","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18104","title":"semvver 1.0.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"semvver","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18105","title":"@securihackbot/depconf-stage-1792484738 1.0.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@securihackbot/depconf-stage-1792484738","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18106","title":"memories-core-web 99.0.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"memories-core-web","versions":["99.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18107","title":"nwfp-build-config 1.0.0, 0.0.0-stage on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"nwfp-build-config","versions":["1.0.0","0.0.0-stage"]}],"vendor":null,"product":null},{"id":"MAL-2026-18109","title":"rs-lookout-sandbox-poc 1.0.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"rs-lookout-sandbox-poc","versions":["1.0.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18110","title":"facewareretargeter 9.9.9 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"facewareretargeter","versions":["9.9.9"]}],"vendor":null,"product":null},{"id":"MAL-2026-18111","title":"hijiko-pilaka 1.0.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"hijiko-pilaka","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18112","title":"hijok-lampam 1.0.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"hijok-lampam","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18113","title":"jiklpo-tsunari-kay 1.0.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"jiklpo-tsunari-kay","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18114","title":"trijigo-kalip 1.0.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"trijigo-kalip","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18116","title":"debbug 1.0.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"debbug","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18117","title":"deebug 1.0.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"deebug","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18118","title":"semer 1.0.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"semer","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18119","title":"ssemver 1.0.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"ssemver","versions":["1.0.0"]}],"vendor":null,"product":null}],"critical":[{"id":"CVE-2026-113252","title":"Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (C","vendor":"Google","product":"Chrome","severity":"Critical","cvss":9.6,"epss":0.00494,"kev_added":null,"kev_due":null,"fixed":["156.0.8078.47"]},{"id":"CVE-2026-113328","title":"Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium secu","vendor":"Google","product":"Chrome","severity":"Critical","cvss":9.6,"epss":0.00494,"kev_added":null,"kev_due":null,"fixed":["156.0.8078.47"]},{"id":"CVE-2026-113235","title":"Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium se","vendor":"Google","product":"Chrome","severity":"Critical","cvss":9.6,"epss":0.00494,"kev_added":null,"kev_due":null,"fixed":["156.0.8078.47"]},{"id":"CVE-2026-113089","title":"Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium","vendor":"Google","product":"Chrome","severity":"Critical","cvss":9.6,"epss":0.00494,"kev_added":null,"kev_due":null,"fixed":["156.0.8078.47"]},{"id":"CVE-2026-113023","title":"Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium s","vendor":"Google","product":"Chrome","severity":"Critical","cvss":9.6,"epss":0.00494,"kev_added":null,"kev_due":null,"fixed":["156.0.8078.47"]},{"id":"CVE-2026-113300","title":"Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security sev","vendor":"Google","product":"Chrome","severity":"Critical","cvss":9.6,"epss":0.00494,"kev_added":null,"kev_due":null,"fixed":["156.0.8078.47"]},{"id":"CVE-2026-113014","title":"Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium securit","vendor":"Google","product":"Chrome","severity":"Critical","cvss":9.6,"epss":0.00494,"kev_added":null,"kev_due":null,"fixed":["156.0.8078.47"]},{"id":"CVE-2026-113189","title":"Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)","vendor":"Google","product":"Chrome","severity":"Critical","cvss":9.6,"epss":0.00494,"kev_added":null,"kev_due":null,"fixed":["156.0.8078.47"]}]},{"date":"2026-10-19","partial":false,"title":"Monday 19 Oct 2026","headline":"32 supply chain compromises.","counts":{"kev":0,"exploited":0,"supply":32,"critical":0},"kev":[],"exploited":[],"supply":[{"id":"MAL-2026-17926","title":"fabdeploycheck 0.1.1 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"fabdeploycheck","versions":["0.1.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17927","title":"fabtoolkit 0.1.2, 0.1.1, 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"fabtoolkit","versions":["0.1.2","0.1.1","0.1.0","0.2.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17928","title":"@fcsmc/commercial-analytics 99.9.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@fcsmc/commercial-analytics","versions":["99.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17929","title":"@fmr-ap149494/apex-base-component 99.9.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@fmr-ap149494/apex-base-component","versions":["99.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17943","title":"vinted-mocked-apis 99.0.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"vinted-mocked-apis","versions":["99.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18045","title":"asurion 99.0.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"asurion","versions":["99.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18065","title":"animate-tailwind-kit 3.0.1, 3.0.4 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"animate-tailwind-kit","versions":["3.0.1","3.0.4"]}],"vendor":null,"product":null},{"id":"MAL-2026-18066","title":"animate-twcss-bridge 2.0.6 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"animate-twcss-bridge","versions":["2.0.6"]}],"vendor":null,"product":null},{"id":"MAL-2026-18067","title":"animate-twcss-pack 2.0.6 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"animate-twcss-pack","versions":["2.0.6"]}],"vendor":null,"product":null},{"id":"MAL-2026-18068","title":"animatecss-tailwind-binary 2.0.6 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"animatecss-tailwind-binary","versions":["2.0.6"]}],"vendor":null,"product":null},{"id":"MAL-2026-18069","title":"animatecss-tailwind-graphic 2.0.6 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"animatecss-tailwind-graphic","versions":["2.0.6"]}],"vendor":null,"product":null},{"id":"MAL-2026-18070","title":"animatecss-tailwind-helper 2.0.6 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"animatecss-tailwind-helper","versions":["2.0.6"]}],"vendor":null,"product":null},{"id":"MAL-2026-18071","title":"animatecss-tailwind-luminary 2.0.6, 2.0.7 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"animatecss-tailwind-luminary","versions":["2.0.6","2.0.7"]}],"vendor":null,"product":null},{"id":"MAL-2026-18072","title":"animatecss-tailwind-plugin 2.0.6 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"animatecss-tailwind-plugin","versions":["2.0.6"]}],"vendor":null,"product":null},{"id":"MAL-2026-18073","title":"animatecss-tailwind-presets 1.0.0, 2.0.3 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"animatecss-tailwind-presets","versions":["1.0.0","2.0.3"]}],"vendor":null,"product":null},{"id":"MAL-2026-18074","title":"animatecss-tailwind-vectrix 2.0.6, 2.0.7 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"animatecss-tailwind-vectrix","versions":["2.0.6","2.0.7"]}],"vendor":null,"product":null},{"id":"MAL-2026-18075","title":"signalledger-bridge 2.0.6 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"signalledger-bridge","versions":["2.0.6"]}],"vendor":null,"product":null},{"id":"MAL-2026-18076","title":"signalledger-diagnostics 2.0.6 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"signalledger-diagnostics","versions":["2.0.6"]}],"vendor":null,"product":null},{"id":"MAL-2026-18077","title":"tailwind-animaflow-kit 2.0.6 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"tailwind-animaflow-kit","versions":["2.0.6"]}],"vendor":null,"product":null},{"id":"MAL-2026-18078","title":"tailwind-animate-kit 2.0.6, 2.0.7, 2.0.8 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"tailwind-animate-kit","versions":["2.0.6","2.0.7","2.0.8"]}],"vendor":null,"product":null},{"id":"MAL-2026-18079","title":"tailwind-animatecss-kit 2.0.6 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"tailwind-animatecss-kit","versions":["2.0.6"]}],"vendor":null,"product":null},{"id":"MAL-2026-18080","title":"tailwind-animationlab 2.0.6 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"tailwind-animationlab","versions":["2.0.6"]}],"vendor":null,"product":null},{"id":"MAL-2026-18081","title":"tailwind-css-keyframes 1.0.7 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"tailwind-css-keyframes","versions":["1.0.7"]}],"vendor":null,"product":null},{"id":"MAL-2026-18082","title":"tailwind-fabric 3.0.1, 3.0.4 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"tailwind-fabric","versions":["3.0.1","3.0.4"]}],"vendor":null,"product":null},{"id":"MAL-2026-18083","title":"tailwind-keyframes 2.0.6 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"tailwind-keyframes","versions":["2.0.6"]}],"vendor":null,"product":null},{"id":"MAL-2026-18084","title":"tailwind-kinetic 2.0.6, 2.0.8 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"tailwind-kinetic","versions":["2.0.6","2.0.8"]}],"vendor":null,"product":null},{"id":"MAL-2026-18085","title":"tailwindcss-animate-catalog 2.0.6, 2.0.7 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"tailwindcss-animate-catalog","versions":["2.0.6","2.0.7"]}],"vendor":null,"product":null},{"id":"MAL-2026-18086","title":"tailwindcss-animatemotion 1.0.7 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"tailwindcss-animatemotion","versions":["1.0.7"]}],"vendor":null,"product":null},{"id":"MAL-2026-18087","title":"tailwindcss-effect-lab 0.0.0-stage, 1.6.7 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"tailwindcss-effect-lab","versions":["0.0.0-stage","1.6.7"]}],"vendor":null,"product":null},{"id":"MAL-2026-18088","title":"tailwindcss-keyframe-kit 3.0.0, 3.0.1, 3.0.2 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"tailwindcss-keyframe-kit","versions":["3.0.0","3.0.1","3.0.2"]}],"vendor":null,"product":null},{"id":"MAL-2026-18089","title":"tailwindcss-motionanimate 1.0.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"tailwindcss-motionanimate","versions":["1.0.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-18090","title":"tailwindcss-visual-kit 0.0.0-stage, 1.3.6 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"tailwindcss-visual-kit","versions":["0.0.0-stage","1.3.6"]}],"vendor":null,"product":null}],"critical":[]},{"date":"2026-10-18","partial":false,"title":"Sunday 18 Oct 2026","headline":"1 reported exploited and not on CISA's list, 3 supply chain compromises.","counts":{"kev":0,"exploited":1,"supply":3,"critical":0},"kev":[],"exploited":[{"id":"CVE-2026-106931","title":"EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability","vendor":"EG Secure Solutions","product":"SiteGuard Server Edition","severity":"High","cvss":7.8,"epss":0.0117,"kev_added":"2026-10-20","kev_due":"2026-10-23","triage":true,"fixed":[],"first":{"at":"2026-10-18T22:41:18.875899Z","source":"Bluesky: zero-day","url":"https://bsky.app/profile/mariogalarza.bsky.social/post/3my6ogdxuiq24"},"outlets":3,"claims":3,"zero_day":true,"waf":[]}],"supply":[{"id":"MAL-2026-17921","title":"leakdeep 2.6.4, 2.5.0, 2.6.6 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"leakdeep","versions":["2.6.4","2.5.0","2.6.6","2.5.2","2.6.0","2.4.1","2.4.5","2.6.2","3.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17922","title":"@pkgship/frpc-linux-arm64 0.71.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@pkgship/frpc-linux-arm64","versions":["0.71.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-18108","title":"rootaccessxvv-bbmarker 1.0.2 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"rootaccessxvv-bbmarker","versions":["1.0.2"]}],"vendor":null,"product":null}],"critical":[]},{"date":"2026-10-17","partial":false,"title":"Saturday 17 Oct 2026","headline":"9 supply chain compromises.","counts":{"kev":0,"exploited":0,"supply":9,"critical":0},"kev":[],"exploited":[],"supply":[{"id":"MAL-2026-17912","title":"driftwavets 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"driftwavets","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17913","title":"emberlytts 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"emberlytts","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17914","title":"glassbeakasr 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"glassbeakasr","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17915","title":"novalithtts 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"novalithtts","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17916","title":"pyrechoasr 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"pyrechoasr","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17917","title":"quasitonnts 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"quasitonnts","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17918","title":"tonemaptts 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"tonemaptts","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17919","title":"ukraine69 1.2.0, 1.2.1, 1.2.2 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"ukraine69","versions":["1.2.0","1.2.1","1.2.2","1.2.3","1.2.5","1.2.6","1.2.7","1.2.8"]}],"vendor":null,"product":null},{"id":"MAL-2026-17920","title":"voltswannts 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"voltswannts","versions":["0.1.0"]}],"vendor":null,"product":null}],"critical":[]},{"date":"2026-10-16","partial":false,"title":"Friday 16 Oct 2026","headline":"2 added to CISA's known exploited list, 7 supply chain compromises.","counts":{"kev":2,"exploited":0,"supply":7,"critical":0},"kev":[{"id":"CVE-2026-102764","title":"BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability","vendor":"BeyondTrust","product":"Remote Support","severity":"Critical","cvss":9.3,"epss":0.0118,"kev_added":"2026-10-16","kev_due":"2026-10-19","triage":true,"fixed":[]},{"id":"CVE-2025-61624","title":"Fortinet Multiple Products Path Traversal Vulnerability","vendor":"Fortinet","product":"Multiple Products","severity":"Medium","cvss":5.4,"epss":0.01081,"kev_added":"2026-10-16","kev_due":"2026-10-19","triage":true,"fixed":[]}],"exploited":[],"supply":[{"id":"MAL-2026-17866","title":"pyyi 2.4.1, 2.4.2, 2.4 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"pyyi","versions":["2.4.1","2.4.2","2.4","2.5.5","2.5.2","2.5.0","2.5.1","2.5.4","2.5.3"]}],"vendor":null,"product":null},{"id":"MAL-2026-17897","title":"fromthehotel-poems 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"fromthehotel-poems","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17898","title":"@flexmr/survey-client 1.0.0, 1.0.12, 3.0.12 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@flexmr/survey-client","versions":["1.0.0","1.0.12","3.0.12","10.0.12","2.0.12"]}],"vendor":null,"product":null},{"id":"MAL-2026-17899","title":"@flexmr/survey-conversation 1.0.12, 10.0.12, 2.0.12 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@flexmr/survey-conversation","versions":["1.0.12","10.0.12","2.0.12","1.0.0","3.0.12"]}],"vendor":null,"product":null},{"id":"MAL-2026-17900","title":"marocolor 1.0.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"marocolor","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17910","title":"itsa-react-focuscontainer 16.0.10 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"itsa-react-focuscontainer","versions":["16.0.10"]}],"vendor":null,"product":null},{"id":"MAL-2026-17911","title":"itsa-react-maskedinput 16.1.2 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"itsa-react-maskedinput","versions":["16.1.2"]}],"vendor":null,"product":null}],"critical":[]},{"date":"2026-10-15","partial":false,"title":"Thursday 15 Oct 2026","headline":"1 added to CISA's known exploited list, 1 reported exploited and not on CISA's list, 11 supply chain compromises, 1 critical flaw in products attackers have targeted.","counts":{"kev":1,"exploited":1,"supply":11,"critical":1},"kev":[{"id":"CVE-2026-21589","title":"Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability","vendor":"Atlassian","product":"Multiple Products","severity":"Critical","cvss":9.3,"epss":0.12711,"kev_added":"2026-10-15","kev_due":"2026-10-18","triage":true,"fixed":[]}],"exploited":[{"id":"CVE-2026-102764","title":"BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability","vendor":"BeyondTrust","product":"Remote Support","severity":"Critical","cvss":9.3,"epss":0.0118,"kev_added":"2026-10-16","kev_due":"2026-10-19","triage":true,"fixed":[],"first":{"at":"2026-10-15T14:00:00Z","source":"Google Threat Intelligence","url":"https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/"},"outlets":6,"claims":7,"zero_day":true,"waf":[]}],"supply":[{"id":"MAL-2026-17881","title":"py-sock2 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"py-sock2","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17883","title":"py-worm 0.1.0, 2.0.0, 2.0.1 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"py-worm","versions":["0.1.0","2.0.0","2.0.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17884","title":"getpubip 0.1.0, 0.1.1, 0.1.2 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"getpubip","versions":["0.1.0","0.1.1","0.1.2"]}],"vendor":null,"product":null},{"id":"MAL-2026-17885","title":"proxyrubika 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"proxyrubika","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17886","title":"py-wormgpt 1.0.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"py-wormgpt","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17887","title":"proxy-rubikis 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"proxy-rubikis","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17889","title":"proxyrobika 0.1.0 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"proxyrobika","versions":["0.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17893","title":"buyerdashboard 45.3.4 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"buyerdashboard","versions":["45.3.4"]}],"vendor":null,"product":null},{"id":"MAL-2026-17894","title":"idlive-face-capture-web-development 78.8.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"idlive-face-capture-web-development","versions":["78.8.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17895","title":"web-pixels-manager 76.2.4 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"web-pixels-manager","versions":["76.2.4"]}],"vendor":null,"product":null},{"id":"MAL-2026-17896","title":"xapi-lib 88.2.5, 88.2.3, 90.2.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"xapi-lib","versions":["88.2.5","88.2.3","90.2.1","90.3.1"]}],"vendor":null,"product":null}],"critical":[{"id":"CVE-2026-110916","title":"Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium secu","vendor":"Google","product":"Chrome","severity":"Critical","cvss":9.6,"epss":0.00338,"kev_added":null,"kev_due":null,"fixed":["155.0.8059.84"]}]},{"date":"2026-10-14","partial":false,"title":"Wednesday 14 Oct 2026","headline":"4 added to CISA's known exploited list, 4 supply chain compromises, 2 critical flaws in products attackers have targeted.","counts":{"kev":4,"exploited":0,"supply":4,"critical":2},"kev":[{"id":"CVE-2026-105134","title":"Ahsay AhsayCBS Command Injection Vulnerability","vendor":"Ahsay","product":"AhsayCBS","severity":"Critical","cvss":10,"epss":0.3831,"kev_added":"2026-10-14","kev_due":"2026-10-17","triage":true,"fixed":[]},{"id":"CVE-2026-105133","title":"Ahsay AhsayCBS Improper Authentication Vulnerability","vendor":"Ahsay","product":"AhsayCBS","severity":"Medium","cvss":6.9,"epss":0.05794,"kev_added":"2026-10-14","kev_due":"2026-10-17","fixed":[]},{"id":"CVE-2026-76519","title":"Cisco Secure Email Gateway Relative Path Traversal Vulnerability","vendor":"Cisco","product":"Secure Email Gateway","severity":"Critical","cvss":9.8,"epss":0.01573,"kev_added":"2026-10-14","kev_due":"2026-10-17","triage":true,"fixed":[]},{"id":"CVE-2026-0322","title":"Palo Alto Networks PAN-OS Code Injection Vulnerability","vendor":"Palo Alto Networks","product":"PAN-OS","severity":"High","cvss":8.6,"epss":0.01215,"kev_added":"2026-10-14","kev_due":"2026-10-17","triage":true,"fixed":["12.2.4","12.1.10-h2","11.2.16"]}],"exploited":[],"supply":[{"id":"MAL-2026-17868","title":"@kre64/hello-npm-test 1.0.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@kre64/hello-npm-test","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17876","title":"@xxxfnbs21/hello-demo 0.1.8, 0.1.6, 0.1.5 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@xxxfnbs21/hello-demo","versions":["0.1.8","0.1.6","0.1.5","0.1.3","0.1.2","0.1.1","0.1.0","0.0.0-stage"]}],"vendor":null,"product":null},{"id":"MAL-2026-17880","title":"seapy-ops 1.0.0, 1.0.1, 1.0.2 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"seapy-ops","versions":["1.0.0","1.0.1","1.0.2","1.1.0","1.1.1","1.1.2","1.2.1","1.2.2"]}],"vendor":null,"product":null},{"id":"MAL-2026-17888","title":"@flexmr/utils 1.0.0, 3.0.12, 1.0.12 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@flexmr/utils","versions":["1.0.0","3.0.12","1.0.12","10.0.12","2.0.12"]}],"vendor":null,"product":null}],"critical":[{"id":"CVE-2026-59774","title":"Gitea Org-mode file disclosure and code execution","vendor":"Gitea","product":"Gitea","severity":"Critical","cvss":9.8,"epss":0.28308,"kev_added":null,"kev_due":null,"fixed":["1.27.1"]},{"id":"CVE-2026-110447","title":"Collabora Online – Built-in CODE Server OS Command Injection Vulnerability","vendor":"Collabora","product":"Collabora Online – Built-in CODE Server","severity":"Critical","cvss":9.2,"epss":0.01225,"kev_added":"2026-10-23","kev_due":"2026-10-26","triage":true,"fixed":["26.4.303"]}]},{"date":"2026-10-13","partial":false,"title":"Tuesday 13 Oct 2026","headline":"2 added to CISA's known exploited list, 1 reported exploited and not on CISA's list, 7 supply chain compromises, 8 critical flaws in products attackers have targeted.","counts":{"kev":2,"exploited":1,"supply":7,"critical":8},"kev":[{"id":"CVE-2026-104935","title":"Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability","vendor":"Ivanti","product":"Connect Secure","severity":"High","cvss":8.6,"epss":0.25982,"kev_added":"2026-10-13","kev_due":"2026-10-16","triage":true,"fixed":[]},{"id":"CVE-2026-96951","title":"Microsoft Windows Command Injection Vulnerability","vendor":"Microsoft","product":"Windows","severity":"High","cvss":8.8,"epss":0.01512,"kev_added":"2026-10-13","kev_due":"2026-10-16","triage":true,"fixed":["20260925.100","10.0.14393.9612","10.0.17763.9376"]}],"exploited":[{"id":"CVE-2026-108398","title":".NET Framework Security Feature Bypass Vulnerability","vendor":"Microsoft","product":"Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2","severity":"High","cvss":8.8,"epss":0.00475,"kev_added":null,"kev_due":null,"fixed":["2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0","2.0.50727.9073 AND 3.0.30729.9070 AND 4.7.4150.0","2.0.50727.9073 AND 3.0.30729.9070 AND 4.8.4811.0"],"first":{"at":"2026-10-13T23:24:53Z","source":"Krebs on Security","url":"https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws/"},"outlets":3,"claims":2,"zero_day":true,"waf":[]}],"supply":[{"id":"MAL-2026-17849","title":"brass-common 99.9.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"brass-common","versions":["99.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17851","title":"yoodan-github-single-ver-pkg 1.0.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"yoodan-github-single-ver-pkg","versions":["1.0.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17861","title":"sysdiagd 1.2.1, 1.2.2, 1.2.3 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"sysdiagd","versions":["1.2.1","1.2.2","1.2.3"]}],"vendor":null,"product":null},{"id":"MAL-2026-17862","title":"fontcase 0.1.0, 0.1.1, 0.1.2 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"fontcase","versions":["0.1.0","0.1.1","0.1.2"]}],"vendor":null,"product":null},{"id":"MAL-2026-17863","title":"crelic-bqwheel-52f66a3f1d 0.0.1 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"crelic-bqwheel-52f66a3f1d","versions":["0.0.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17867","title":"@accenturecodefoundry/mfe-pot-shared-ui-scds-core 99.99.2, 99.99.4, 99.99.41 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@accenturecodefoundry/mfe-pot-shared-ui-scds-core","versions":["99.99.2","99.99.4","99.99.41","99.99.43"]}],"vendor":null,"product":null},{"id":"MAL-2026-17879","title":"@flexmr/ui 99.99.99 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@flexmr/ui","versions":["99.99.99"]}],"vendor":null,"product":null}],"critical":[{"id":"CVE-2026-97229","title":"Integer Overflow or Wraparound in GitLab","vendor":"GitLab","product":"GitLab","severity":"Critical","cvss":10,"epss":0.00547,"kev_added":null,"kev_due":null,"fixed":["19.2.8","19.3.5","19.4.2"]},{"id":"CVE-2026-110152","title":"Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium se","vendor":"Google","product":"Chrome","severity":"Critical","cvss":9.6,"epss":0.00406,"kev_added":null,"kev_due":null,"fixed":["155.0.8059.79"]},{"id":"CVE-2026-109750","title":"Firefox: Site isolation issue in the DOM: Web Authentication component","vendor":"Mozilla","product":"Firefox","severity":"Critical","cvss":9.6,"epss":0.0038,"kev_added":null,"kev_due":null,"fixed":[]},{"id":"CVE-2026-109745","title":"Firefox: Sandbox escape due to uninitialized memory in the DOM: Web Serial component","vendor":"Mozilla","product":"Firefox","severity":"Critical","cvss":9.6,"epss":0.00349,"kev_added":null,"kev_due":null,"fixed":[]},{"id":"CVE-2026-109740","title":"Firefox: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component","vendor":"Mozilla","product":"Firefox","severity":"Critical","cvss":9.6,"epss":0.00349,"kev_added":null,"kev_due":null,"fixed":[]},{"id":"CVE-2026-110161","title":"Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Crit","vendor":"Google","product":"Chrome","severity":"Critical","cvss":9.6,"epss":0.0034,"kev_added":null,"kev_due":null,"fixed":["155.0.8059.79"]},{"id":"CVE-2026-109755","title":"Firefox: Sandbox escape in the DOM: Content Processes component","vendor":"Mozilla","product":"Firefox","severity":"Critical","cvss":9.6,"epss":0.00338,"kev_added":null,"kev_due":null,"fixed":[]},{"id":"CVE-2026-110136","title":"Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)","vendor":"Google","product":"Chrome","severity":"Critical","cvss":9.6,"epss":0.00338,"kev_added":null,"kev_due":null,"fixed":["155.0.8059.79"]}]},{"date":"2026-10-12","partial":false,"title":"Monday 12 Oct 2026","headline":"4 supply chain compromises.","counts":{"kev":0,"exploited":0,"supply":4,"critical":0},"kev":[],"exploited":[],"supply":[{"id":"MAL-2026-17806","title":"ap3-foundations-ui 99.0.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"ap3-foundations-ui","versions":["99.0.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17808","title":"@s4yhiitestpoc/r2-https-b 1.0.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@s4yhiitestpoc/r2-https-b","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17809","title":"minecraftaccfinder 0.1.0, 0.1.1, 0.1.2 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"minecraftaccfinder","versions":["0.1.0","0.1.1","0.1.2","0.3.0","0.3.1","0.4.0","2.0.0","3.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17847","title":"npp-ml 0.1.7, 0.1.8, 0.1.9 on PyPI was a malicious release","kind":"release","packages":[{"ecosystem":"pypi","name":"npp-ml","versions":["0.1.7","0.1.8","0.1.9","0.1.10"]}],"vendor":null,"product":null}],"critical":[]},{"date":"2026-10-11","partial":false,"title":"Sunday 11 Oct 2026","headline":"42 supply chain compromises.","counts":{"kev":0,"exploited":0,"supply":42,"critical":0},"kev":[],"exploited":[],"supply":[{"id":"MAL-2026-17758","title":"react-dropzone-v4 99.0.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"react-dropzone-v4","versions":["99.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17764","title":"@s4yhiitestpoc/r2-https 1.0.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@s4yhiitestpoc/r2-https","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17765","title":"@s4yhiitestpoc/r3-https 1.0.0, 0.0.0-stage on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@s4yhiitestpoc/r3-https","versions":["1.0.0","0.0.0-stage"]}],"vendor":null,"product":null},{"id":"MAL-2026-17766","title":"@s4yhiitestpoc/scan-https-d 1.0.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"@s4yhiitestpoc/scan-https-d","versions":["1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17767","title":"another-very-long-name 2.0.0, 1.0.1, 2.0.1 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"another-very-long-name","versions":["2.0.0","1.0.1","2.0.1","1.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17768","title":"cloudflare_module 3.0.0, 1.0.1, 1.0.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"cloudflare_module","versions":["3.0.0","1.0.1","1.0.0","99.0.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17769","title":"deposit-limit-fe 100.100.106, 100.100.101, 100.100.102 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"deposit-limit-fe","versions":["100.100.106","100.100.101","100.100.102"]}],"vendor":null,"product":null},{"id":"MAL-2026-17770","title":"ksp-app 100.100.100 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"ksp-app","versions":["100.100.100"]}],"vendor":null,"product":null},{"id":"MAL-2026-17771","title":"ksp-client-registry 100.100.100, 100.100.101 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"ksp-client-registry","versions":["100.100.100","100.100.101"]}],"vendor":null,"product":null},{"id":"MAL-2026-17773","title":"nested-lib 1.0.0, 1.0.1, 1.1.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"nested-lib","versions":["1.0.0","1.0.1","1.1.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17774","title":"nitro-bundled-dep 99.0.1, 2.0.1, 1.1.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"nitro-bundled-dep","versions":["99.0.1","2.0.1","1.1.0","0.0.1","1.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17775","title":"nitro-cjs-requirer 1.0.0, 0.0.1, 1.1.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"nitro-cjs-requirer","versions":["1.0.0","0.0.1","1.1.0","2.0.0","99.0.1","3.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17776","title":"pay-methods-kmf 100.100.102, 100.100.100, 100.100.101 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"pay-methods-kmf","versions":["100.100.102","100.100.100","100.100.101"]}],"vendor":null,"product":null},{"id":"MAL-2026-17777","title":"react-paginate-v5 99.0.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"react-paginate-v5","versions":["99.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17778","title":"some-very-long-package-name 2.0.0, 1.0.0, 3.0.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"some-very-long-package-name","versions":["2.0.0","1.0.0","3.0.0","2.0.1","99.0.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17779","title":"airdrop-eligibility-check 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"airdrop-eligibility-check","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17780","title":"block-explorer-api 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"block-explorer-api","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17781","title":"btc-fee-estimator 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"btc-fee-estimator","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17782","title":"crypto-tax-export 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"crypto-tax-export","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17783","title":"defi-yield-calculator 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"defi-yield-calculator","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17784","title":"dex-router-abis 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"dex-router-abis","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17785","title":"erc20-approve-audit 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"erc20-approve-audit","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17786","title":"eth-gas-oracle 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"eth-gas-oracle","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17787","title":"evm-tx-decoder 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"evm-tx-decoder","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17788","title":"gas-refuel-bridge 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"gas-refuel-bridge","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17789","title":"hd-wallet-generator 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"hd-wallet-generator","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17790","title":"mev-sandwich-detect 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"mev-sandwich-detect","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17791","title":"multichain-rpc 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"multichain-rpc","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17792","title":"nft-metadata-resolver 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"nft-metadata-resolver","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17793","title":"perp-funding-rates 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"perp-funding-rates","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17794","title":"seed-phrase-validator 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"seed-phrase-validator","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17795","title":"sol-mint-utils 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"sol-mint-utils","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17796","title":"staking-apr-fetcher 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"staking-apr-fetcher","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17797","title":"ton-jetton-tools 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"ton-jetton-tools","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17798","title":"tron-trc20-utils 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"tron-trc20-utils","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17799","title":"wallet-balance-scanner 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"wallet-balance-scanner","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17800","title":"wallet-hd-derive 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"wallet-hd-derive","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17801","title":"web3-signer-kit 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"web3-signer-kit","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17802","title":"xrp-ledger-utils 0.9.1 on RubyGems was a malicious release","kind":"release","packages":[{"ecosystem":"gem","name":"xrp-ledger-utils","versions":["0.9.1"]}],"vendor":null,"product":null},{"id":"MAL-2026-17803","title":"hridoy-ultimate 8.0.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"hridoy-ultimate","versions":["8.0.0"]}],"vendor":null,"product":null},{"id":"MAL-2026-17848","title":"orderly-plugin-liquidity-heatmap 1.0.0, 1.0.1, 1.0.2 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"orderly-plugin-liquidity-heatmap","versions":["1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","1.0.6"]}],"vendor":null,"product":null},{"id":"MAL-2026-17878","title":"util-foriepft 1.0.0 on npm was a malicious release","kind":"release","packages":[{"ecosystem":"npm","name":"util-foriepft","versions":["1.0.0"]}],"vendor":null,"product":null}],"critical":[]}]}