Malicious code in p12-pem (npm)
Newly collected advisory
MAL-2026-18265
Assessment context
Newly collected advisory; observed by ChangeIntel, not the original publication date.
No access to your tenant or devices. Every item links to its source. What this means
Week 43 · 19 Oct – 25 Oct 2026 UTC · assess the changes, then plan the next dates.
SecurityMalicious code in p12-pem (npm)
Newly collected advisory
MAL-2026-18265
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityMalicious code in paychex-pdftron (npm)
Newly collected advisory
MAL-2026-18289
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityMalicious code in react-native-bright-sdk (npm)
Newly collected advisory
MAL-2026-18290
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityMalicious code in redis-dumper (npm)
Newly collected advisory
MAL-2026-18266
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityMalicious code in sc-hydrate-carousel-price (npm)
Newly collected advisory
MAL-2026-18291
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityMalicious code in sound-cloud-loader-api (npm)
Newly collected advisory
MAL-2026-18267
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityMalicious code in tailwind-base-buttons (npm)
Newly collected advisory
MAL-2026-18250
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityMalicious code in tailwindcss-theme-kit (npm)
Newly collected advisory
MAL-2026-18251
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityMalicious code in tiktok-video-scraper (npm)
Newly collected advisory
MAL-2026-18268
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityMalicious code in tostpro (npm)
Affected-version evidence changed
MAL-2026-17564
Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
SecurityMalicious code in w-mousekey (npm)2 source records
Affected-version evidence changed
MAL-2026-18293
Affected-version evidence changed; observed by ChangeIntel, not the original publication date.
Newly collected advisory
MAL-2026-18293
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityMalicious code in youtube-info-streams (npm)
Newly collected advisory
MAL-2026-18269
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityMalicious code in youtube-search-without-api-key (npm)
Newly collected advisory
MAL-2026-18270
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityNiubiGEO before 0.3.2 Unauthenticated SSRF via /audit-plan domain Field
Newly collected advisory
CVE-2026-116069
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityOpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket
Newly collected advisory
CVE-2026-116184
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityOpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos
Newly collected advisory
CVE-2026-116185
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityOpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId
Newly collected advisory
CVE-2026-116186
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityPaisa before 0.7.8 Path Traversal via Editor and Sheet API
Newly collected advisory
CVE-2026-116067
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityParse Server 9.0.0 before 9.10.4-alpha.3 Reserved Field Name Injection via Object Writes
Newly collected advisory
CVE-2026-116164
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityParse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB
Newly collected advisory
CVE-2026-116165
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityParse Server 9.0.0 before 9.10.5-alpha.2 Authentication Bypass via AuthAdapter Subclasses
Newly collected advisory
CVE-2026-116163
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityParse Server 9.0.0 before 9.10.5-alpha.4 LiveQuery Information Disclosure via $or Subscriptions
Newly collected advisory
CVE-2026-116161
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityParse Server 9.0.0 before 9.10.5-alpha.5 Privilege Escalation via SMS MFA Login
Newly collected advisory
CVE-2026-116162
Newly collected advisory; observed by ChangeIntel, not the original publication date.
SecurityPrivoce Vocechat Query Parameter widget.html cross site scripting
Newly collected advisory
CVE-2026-116047
Newly collected advisory; observed by ChangeIntel, not the original publication date.
Groups collect records about the same product or named security topic on one UTC date. Open a record for its source and history; grouping alone does not establish a shared cause or impact.