MAL-2026-11468 Malicious code in install-native-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 757eb666248556142f82ce2793cd42e7e30db4ce65efc823eaed2a71c14087f2 lib/report.js collects host and user identifying data via os.hostname, os.userInfo, execSync-invoked system commands, and fs.readFileSync of local...

MAL-2026-11422 Malicious code in asdk-plugin-alphagen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d3479f5a67e780468835828895609215d82aa5a273dfc152e4bae5a12f21a245 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-11423 Malicious code in asdk-plugin-legacy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 65dd9dd087b805a16fb5d68c92cf2be0ec28fec162d75bb0eb81bb8d9bcfb61a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-11200 Malicious code in ml-fdbk-shared (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2f2313f59d10884a764cb2e2dbfe3aa8ae97545c995785f65ca1e856b4a29b8c During installation, package exfiltrates basic info and all environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

SUSE CVE-2026-42222

Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the initial installation window exposed by POST /api/install. At time of publication no public patches are available...

SUSE CVE-2026-45152

uniget is a universal installer and updater for container tools. Prior to 0.27.1, a command injection vulnerability exists in uniget due to unsafe execution of the check field from metadata files using /bin/bash -c. Because the check field is loaded directly from untrusted JSON metadata without...

MAL-2026-11195 Malicious code in phabricator-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43e718b20986295f99dd35066e46d0be5629555dccab79a1727cd3f5044cb7a0 phabricator-client 99.0.4 is a single-file PyPI package whose only runtime effect on import is to resolve lobohunter.duckdns.org and open a TCP...

CVE-2026-17976

Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to bypass discretionary access control via a crafted domain name. Chromium security severity: Low...

CVE-2026-17755

Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2026-17739

Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML UXSS via a crafted Chrome Extension. Chromium security severity: Medium...

PT-2026-66456

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wps sfw install plugin configuration AJAX handler. Thi...

CVE-2026-13346 pip absolute path traversal during download from malicious package indexes

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone...

CVE-2026-13346

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone...

GHSA-9XQ3-3FQG-4VG7 `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

Repository: termux/proot-distro Component: prootdistro/commands/install.py → extractplaintar; also helpers/docker.py → applylayer --- Affected Versions | Component | Version | |---------------|------------------------------| | proot-distro | 5.0.2 confirmed vulnerable | | Termux app |...

CVE-2026-54574

CVE-2026-54574 affects proot-distro prior to 5.1.5. The flaw resides in extraction paths: _extract_plain_tar() (proot_distro/commands/install.py) and _apply_layer() (proot_distro/helpers/docker.py) do not validate symlink targets (member.linkname). A tar archive can plant an absolute host-path sy...

CVE-2026-54574 `proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

proot-distro is a utility for managing proot containers. Prior to version 5.1.5, proot-distro install extracted plain tarball root filesystems through extractplaintar in prootdistro/commands/install.py and Docker layers through applylayer in prootdistro/helpers/docker.py without validating...

PT-2026-65874

Name of the Vulnerable Software and Affected Versions openSUSE Tumbleweed python311-pip versions prior to 26.2-1.1 Description pip incorrectly handles doubly-encoded package URLs from indexes. This allows files to be installed to arbitrary locations on disk, even when installing wheels pre-compil...

MAL-2026-11134 Malicious code in color-convert-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ede9e30312b6e32aeb2a3ed39042fed67db7f1cee50591f906a228f61673ef9 The package's postinstall.js runs automatically on npm install and executes a shell pipeline that collects host identity hostname, whoami, id, sudo -...

MAL-2026-11145 Malicious code in rollup-runtime-core-polyfills (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 868d4b253cfa762cd40d8064b3a99cbed00203fbed19402d5033551720690199 The package presents itself as a rollup polyfill plugin and copies the source of rollup-plugin-polyfill-node repository field points to...

Malicious code in @apexfnd/apex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8716e3bd410648407039879f991abe8adbde650ab008bac4e41165e7b52c79b1 The npm package @apexfnd/apex ships a postinstall script install.cjs that performs two install-time remote-code-execution actions. On macOS it writes...