Malicious code in z-shop-js-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c910274a4f0635a1545efdbfbd102ee02489acc2cc2e37c2c5bec67beb6ea1eb The package z-shop-js-env was found to contain malicious code. Source: ghsa-malware 9a1ecf70acc2b9592534b8c85342bac4b887b74656f5c9d971d51375fed00d9f...

CVE-2025-70841

Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuration data via direct request to /script/.env file. The exposed file contains Laravel application encryption key APPKEY, database credentials, SMTP/SendGrid API...

Malicious code in cookie-parsers-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4a2885cd84876f478aa25e2b8efddc48e11530aef832f085e0b9d8d114ae481 The package cookie-parsers-env was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview cookie-parsers-env is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-678 Malicious code in cookie-parsers-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4a2885cd84876f478aa25e2b8efddc48e11530aef832f085e0b9d8d114ae481 The package cookie-parsers-env was found to contain malicious code. Source: ghsa-malware...

PT-2026-5987

Name of the Vulnerable Software and Affected Versions Dokans Multi-Tenancy Based eCommerce Platform version 3.9.2 Description The platform allows unauthenticated remote attackers to obtain sensitive application configuration data by directly requesting the '/script/.env' file. This file contains...

CVE-2025-70841

Dokans Multi-Tenancy Based eCommerce Platform SaaS version 3.9.2 is vulnerable to unauthenticated remote access to the /script/.env file. The exposure reveals sensitive data including the Laravel APP_KEY, database credentials, SMTP/SendGrid API credentials, and internal configuration parameters, ...

CVE-2025-70841

Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuration data via direct request to /script/.env file. The exposed file contains Laravel application encryption key APPKEY, database credentials, SMTP/SendGrid API...

CVE-2025-70841

Dokans Multi-Tenancy Based eCommerce Platform SaaS 3.9.2 allows unauthenticated remote attackers to obtain sensitive application configuration data via direct request to /script/.env file. The exposed file contains Laravel application encryption key APPKEY, database credentials, SMTP/SendGrid API...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005086)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005086 advisory. In the Linux kernel, the following vulnerability has been resolved: kobjectuevent: Fix OOB access within zapmodaliasenv zapmodaliasenv wrongly calculates size of...

CVE-2025-59472

A denial of service vulnerability exists in Next.js versions with Partial Prerendering PPR enabled when running in minimal mode. The PPR resume endpoint accepts unauthenticated POST requests with the Next-Resume: 1 header and processes attacker-controlled postponed state data. Two closely related...

EUVD-2026-3514

Malicious code in dot-env-buffer npm...

MAL-2026-358 Malicious code in dot-env-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6b904cb582cf9170852021ecdcf038d94bbdeba48b650873716c45f7b64428a The package dot-env-buffer was found to contain malicious code. Source: ghsa-malware c4ad07e4f6d317d9cc416752d30839302c835d6eb881eed62ddba910fcd47945...

Malicious code in dot-env-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6b904cb582cf9170852021ecdcf038d94bbdeba48b650873716c45f7b64428a The package dot-env-buffer was found to contain malicious code. Source: ghsa-malware c4ad07e4f6d317d9cc416752d30839302c835d6eb881eed62ddba910fcd47945...

Malicious Package

Overview dot-env-buffer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MiracleLinux 8 : postgresql:15 (AXSA:2024-9055:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-9055:01 advisory. postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID CVE-2024-10978 postgresql: PostgreSQL PL/Perl environment variable...

Inclusion of Sensitive Information in Source Code

Overview Affected versions of this package are vulnerable to Inclusion of Sensitive Information in Source Code via the EnvironmentPlugin , which exposed all build environment variables. An attacker can access sensitive environment variables, including credentials and API keys, by inspecting...

CVE-2025-69262 pnpm vulnerable to Command Injection via environment variable substitution

pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Cod...

Linux Distros Unpatched Vulnerability : CVE-2023-54279

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MIPS: fw: Allow firmware to pass a empty env fwgetenv will use env entry to determine style of env, however it is legal for firmware to just pass a empty list...

UBUNTU-CVE-2023-54279

In the Linux kernel, the following vulnerability has been resolved: MIPS: fw: Allow firmware to pass a empty env fwgetenv will use env entry to determine style of env, however it is legal for firmware to just pass a empty list. Check if first entry exist before running strchr to avoid null pointe...