41250 matches found
Malicious code in chai-as-deployer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4da130c2818dc609c23c93511a70a6c207cf19cdf9fdd937e369e07b5f1e492 The package is published as chai-as-deployer but its tarball contains verbatim pino README/docs/type-definitions while the advertised chai plugin is ...
EUVD-2026-55377
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: fix cleaner shader IB buffer overflow The cleaner shader sysfs path allocates a 16-dword 64 byte IB but incorrectly fills alignmask + 1 dwords. On GFX rings alignmask is 0xff, so the loop wrote 256 dwords into a...
Malicious code in @noobaihome/amis-uni-area-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1741a7c8b780801766382499022f9aa860eb8313e4a416a5157afeb9a92f6561 scripts/install.js runs during npm preinstall and performs three attacker-beneficial actions against the installer host. First, it unconditionally...
Malicious code in simple-date-formatter-new-9 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5000b7987ca50d065efc0f5a3ba7c724cb73ac0e23f54347cff8b30aa6eb5d3b package.json declares a postinstall script that opens an interactive bash reverse shell to the hardcoded remote address 124.221.154.135:4444 during n...
MAL-2026-13698 Malicious code in simple-date-formatter-new-9 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5000b7987ca50d065efc0f5a3ba7c724cb73ac0e23f54347cff8b30aa6eb5d3b package.json declares a postinstall script that opens an interactive bash reverse shell to the hardcoded remote address 124.221.154.135:4444 during n...
Malicious code in simple-date-formatter-new-10 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1cc0707c5a58067075648ef1c040ceeb07c2550b9f06d53b5c8c41ec167c841 [email protected] presents itself as a trivial date-formatting utility but ships two attack payloads that fire when npm installs the...
MAL-2026-13697 Malicious code in simple-date-formatter-new-10 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1cc0707c5a58067075648ef1c040ceeb07c2550b9f06d53b5c8c41ec167c841 [email protected] presents itself as a trivial date-formatting utility but ships two attack payloads that fire when npm installs the...
CVE-2026-72580
An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...
AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
SummaryThe AWS Command Line Interface AWS CLI is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands aws emr ssh, aws emr socks, aws emr put, aws emr get passed StrictHostKeyChecking=no to the underlying SSH client, disabling host key...
CVE-2026-72589 alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...
EUVD-2026-55217
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...
CVE-2026-72589
An OS command injection vulnerability affects alseambusher/crontab-ui up to version 0.4.2. An unauthenticated remote attacker can trigger arbitrary system commands by importing a crafted crontab database file via POST /import, which accepts arbitrary .db files and overwrites the application datab...
CVE-2026-72589 alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...
CVE-2026-72589 alseambusher crontab-ui - Unauthenticated RCE via Shell Injection in Imported Database hook Field
An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...
CVE-2026-72580
An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
CVE-2026-23744 – MCPJam Inspector Unauthenticated RCE PoC...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
CVE-2026-23744-PoC Disclaimer: This proof-of-concept...
Solidity Pro VS Code Extensions Steal Crypto Wallets, API Keys, and Credentials
Cybersecurity researchers have flagged a malicious Microsoft Visual Studio Code VS Code extension named Solidity Pro "solidity-pro" that has been observed delivering a browser wallet and credential stealer. The names of the extensions are below - helper-beeps.solidity-pro web3devtoolsx.solidity-p...
OpenSMTPD - MAIL FROM Command Injection Detection (CVE-2020-7247)
Detects OpenSMTPD CVE-2020-7247 by sending a crafted MAIL FROM address containing shell metacharacters MAIL FROM: and checking whether the server accepts it with a 250 Ok response. !/usr/bin/env python3 -- coding: utf-8 -- """OpenSMTPD MAIL FROM command injection CVE-2020-7247.""" import secrets...