MAL-2026-12045 Malicious code in statist-browser-typed-client-hra.workplacer.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4cbfd025a99e15c1b81ff3a4bab4b52e4575f00b5328fe210fd8fb3fe9df9f8 On require of the package's main entry index.js, polyfill.js downloads a platform-specific binary from one of several hosts whose names are...

Malicious code in sextant-cli-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53 The package is a platform-specific leaf linux/arm64 whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits...

MAL-2026-12043 Malicious code in sextant-cli-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc34f69b5a68c549feccfb32cc2dbfbf2d4c787a4876241027b4299305fd2c53 The package is a platform-specific leaf linux/arm64 whose only shipped artifact is a 12 MB stripped Go binary at bin/sxt. The package.json omits...

SUSE CVE-2026-18654

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To...

Malicious code in sextant-cli-darwin-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d2e5ab6503eb2b9c12bf64e34cb2fe12227c07b179231ebe23f13b8866181f1 The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main, no bin mapping, and no...

MAL-2026-12028 Malicious code in sextant-cli-darwin-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d2e5ab6503eb2b9c12bf64e34cb2fe12227c07b179231ebe23f13b8866181f1 The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main, no bin mapping, and no...

Malicious code in sextant-cli-linux-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aab426dad8f1e5722f2836debe2f93730df98b7c109865426208edb687955b30 sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay at wss://relay.sextant.top a...

MAL-2026-12029 Malicious code in sextant-cli-linux-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aab426dad8f1e5722f2836debe2f93730df98b7c109865426208edb687955b30 sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay at wss://relay.sextant.top a...

MAL-2026-12000 Malicious code in streak-math-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3769541ab9576413a88f4e32ef21b55090b7efc17fd44750269f9e19e854abb1 The package's module entry dist/index.mjs runs a top-level IIFE on import that chmods dist/math-calc.bin to 0755 and spawns it detached...

MAL-2026-11997 Malicious code in sextant-cli-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23978b08a7e3f8af97d2c8060e7fc3aca9a18d9f3435163a9d3ab97ac0b9d4d0 Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://relay.sextant.top and links a...

Malicious code in sextant-cli-darwin-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23978b08a7e3f8af97d2c8060e7fc3aca9a18d9f3435163a9d3ab97ac0b9d4d0 Package ships a darwin/arm64 Go binary that opens an outbound WebSocket to a hardcoded author-controlled relay at wss://relay.sextant.top and links a...

PT-2026-68011

Name of the Vulnerable Software and Affected Versions HashBrown CMS versions prior to 1.4.7 Description The Git deployer component contains an OS Command Injection flaw. The pullRepo function in src/Server/Entity/Deployer/GitDeployer.js uses AppService.exec to run a shell command that interpolate...

PT-2026-68894

Name of the Vulnerable Software and Affected Versions dracut affected versions not specified Description A flaw exists in the die error-handling function which writes messages into a shell script within the initramfs emergency-hook directory without proper shell-quoting. An attacker on the adjace...

PT-2026-68331

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.0 Description In the backend/sftp/sftp.go file, the software interpolates remote SFTP paths into PowerShell hash commands. The quoteOrEscapeShellPath function only escapes ASCII apostrophes, failing to account for...

Exploit for CVE-2026-60004

CVE-2026-60004 - Gitea Once executed, the script will automa...

GHSA-5GPJ-VJ23-VHHV Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that getverifieduser enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or...

Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check

Summary The terminal WebSocket route authenticates its own first-message JWT instead of going through the HTTP dependency chain, and never applies the role check that getverifieduser enforces on every HTTP terminal route. An account whose role is pending, meaning registered but not approved, or...

CVE-2025-29296

H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NE36 Pro V100R002 and H3C MC102G HM1A0V200R010 contain multiple command injection vulnerabilities in the /api/esps request handler. The...

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

NPM: Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

GHSA-VMV7-4M6C-3CG5 Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

UPDATE 2026-05-20: Full RCE as root VERIFIED This is not theoretical — a Meterpreter reverse shell session as root has been established on Flowise 3.1.2. Verified Exploit Chain 1. Python code injection via base64string = "$base64String" CSVAgent.ts line 161 2. Pyodide js bridge provides access to...