omolab-conf-analysis (>=0.0.1, <=0.0.2) potentially affected by CVE-2024-43805 via jupyterlab (2.2.8)

jupyterlab PYPI version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - omolab-conf-analysis =0.0.1, =0.0.2 Source cves: CVE-2024-43805 Source advisory: OSV:PYSEC-2026-2536...

omolab-conf-analysis (>=0.0.1, <=0.0.2) potentially affected by CVE-2024-22421 via jupyterlab (2.2.8)

jupyterlab PYPI version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - omolab-conf-analysis =0.0.1, =0.0.2 Source cves: CVE-2024-22421 Source advisory: OSV:PYSEC-2026-2534...

GHSA-P4M3-MGMM-C664 SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read), Incomplete fix of CVE-2026-41894

Summary The patch for CVE-2026-41894 "Path Traversal via Double URL Encoding" sanitized the /export/ route but the identical root cause remains in the /assets/path route. In publish mode anonymous read-only HTTP endpoint, default port 6808, an unauthenticated remote attacker can read arbitrary...

EUVD-2026-42725

A security vulnerability has been detected in TOTOLINK A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185RT10 and EX200 up to 20260906. Affected by this issue is some unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. The manipulation leads to least privilege...

CVE-2026-59832

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks, allowing an authenticat...

CVE-2026-59832 SiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks, allowing an authenticat...

CVE-2026-59832 SiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks, allowing an authenticat...

CVE-2026-15271

CVE-2026-15271 affects TOTOLINK models A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10 and EX200. The issue concerns an unspecified functionality in the Web Interface component, specifically the file /etc/boa/boa.conf, where manipulation can lead to a least privilege violation . The attack ...

CVE-2026-15270 D-link DIR-823G Web boa.conf least privilege violation

A weakness has been identified in D-link DIR-823G 1.0.2B0520181207. Affected by this vulnerability is an unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. Executing a manipulation can lead to least privilege violation. The attack can be launched remotely. The...

CVE-2026-15270 D-link DIR-823G Web boa.conf least privilege violation

A weakness has been identified in D-link DIR-823G 1.0.2B0520181207. Affected by this vulnerability is an unknown functionality of the file /etc/boa/boa.conf of the component Web Interface. Executing a manipulation can lead to least privilege violation. The attack can be launched remotely. The...

CVE-2026-15270

D-Link DIR-823G (firmware 1.0.2B05_20181207) Web Interface vulnerable via manipulation of /etc/boa/boa.conf, causing a least-privilege violation. Exploit is remote with high complexity; public exploit exists. No remediation details provided in the supplied documents.

Malicious Package

Overview tslint-conf is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

CVE-2026-59832: Improper Limitation of a Pathname to a Restricted Directory

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks, allowing an authenticat...

MAL-2026-10014 Malicious code in nodemon-sudo (npm)

The npm package nodemon-sudo is a typosquat of the popular nodemon package: its package.json description "Simple monitor script for use during development of a Node.js app.", main entry ./lib/nodemon, and forged author field Remy Sharp, the real maintainer of nodemon are copied from the legitimat...

Malicious code in tslint-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31b464b1646f8e2d36ce68a86af599cc49d5381f08af70302ff01f42957234a1 The package presents itself as the pino logger README, index.d.ts, docs/, and lib/ files all reference pinojs/pino but is published under the unrelat...

MAL-2026-7022 Malicious code in tslint-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31b464b1646f8e2d36ce68a86af599cc49d5381f08af70302ff01f42957234a1 The package presents itself as the pino logger README, index.d.ts, docs/, and lib/ files all reference pinojs/pino but is published under the unrelat...

omolab-conf-analysis (>=0.0.1, <=0.0.2) potentially affected by CVE-2025-53000 via nbconvert (6.0.4)

nbconvert PYPI version 6.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on nbconvert and may be impacted: - omolab-conf-analysis =0.0.1, =0.0.2 Source cves: CVE-2025-53000 Source advisory: OSV:PYSEC-2026-1691...

omolab-conf-analysis (>=0.0.1, <=0.0.2) potentially affected by CVE-2025-59842 via jupyterlab (2.2.8)

jupyterlab PYPI version 2.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - omolab-conf-analysis =0.0.1, =0.0.2 Source cves: CVE-2025-59842 Source advisory: OSV:PYSEC-2026-1482...

PT-2026-54917

Name of the Vulnerable Software and Affected Versions Shenzhen Aitemi M300 Wi-Fi Repeater hardware model MT02 affected versions not specified Description An unauthenticated OS command injection exists in the commuos web backend. Network-adjacent attackers can execute arbitrary shell commands by...

Malicious code in colorpicker-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 226e4e81049c5688a16a198fb9a90ab3d11d371b621e367da4590632f4e5e140 Package presents itself as a minimal React color-picker but ships a postinstall hook "postinstall": "node setup.js" that performs targeted credential...