CVE-2026-82804 Apache DolphinScheduler: Command Injection in the Alert Script Plugin

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

org.apache.dolphinscheduler:dolphinscheduler-alert-all (>=3.2.0, <=3.4.2), org.apache.dolphinscheduler:dolphinscheduler-alert-server (>=2.0.1, <=3.4.2) +2 more potentially affected by CVE-2026-82804 via org.apache.dolphinscheduler:dolphinscheduler-alert-script (>=2.0.1, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-alert-script MAVEN version =2.0.1, =3.2.0, =2.0.1, =2.0.1, =2.0.1, =3.0.6 Source cves: CVE-2026-82804 Source advisory: MEND:CVE-2026-82804...

MAL-2026-17244 Malicious code in exprrdd (npm)

The package exprrdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17246 Malicious code in exptred (npm)

The package exptred impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in exprrdd (npm)

The package exprrdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

PT-2026-102894

Name of the Vulnerable Software and Affected Versions mcp-chrome-bridge versions prior to 1.0.32 Description An origin validation error exists in the native-server HTTP API that allows attackers to bypass Cross-Origin Resource Sharing CORS restrictions. CORS is a security mechanism that restricts...

PT-2026-102891

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

CVE-2026-102675: Origin Validation Error

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI...

CVE-2026-102878: Origin Validation Error

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

CVE-2026-102875: Improper Limitation of a Pathname to a Restricted Directory

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

CVE-2026-82804: Improper Neutralization of Special Elements used in an OS Command

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

PT-2026-102608

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

PT-2026-102671

Name of the Vulnerable Software and Affected Versions serialize-javascript versions 7.1.1 through 7.1.1 Description serialize-javascript converts JavaScript values into a JSON superset that includes functions and regular expressions. A flaw exists where function values are not fully protected...

PT-2026-102710

Name of the Vulnerable Software and Affected Versions Electron versions prior to 41.10.6 Electron versions prior to 42.9.2 Electron versions prior to 43.4.1 Electron versions prior to 44.0.0-beta.5 Description Responses served through the protocol.registerFileProtocol or...

PT-2026-102816

Name of the Vulnerable Software and Affected Versions JupyterLab versions 4.5.0 through 4.5.10 JupyterLab versions 4.6.0 through 4.6.3 Notebook versions 7.5.0 through 7.6.2 JupyterLite Core versions 0.7.0 through 0.8.3 Description The system clipboard cell-paste path accepts attacker-controlled...

Malicious code in test-agency-assignment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcdf62e1c1eb44ca7a29ed37c12bdb71883025a46c5066e58c9228f0dfe782c2 package.json declares a postinstall lifecycle script wscript.exe 4444.vbs, causing the VBS file shipped in the tarball to run automatically on npm...

Malicious code in simple-date-formatter-new-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd79db99adb8878673dd85db5a29661432808fa8fcc5e3d750b907418df8ae5f npm package [email protected] declares a postinstall lifecycle script in package.json that runs automatically on npm install. The...

MAL-2026-17229 Malicious code in simple-date-formatter-new-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd79db99adb8878673dd85db5a29661432808fa8fcc5e3d750b907418df8ae5f npm package [email protected] declares a postinstall lifecycle script in package.json that runs automatically on npm install. The...

MAL-2026-17223 Malicious code in chalk-figlet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b package.json declares a postinstall script node example.js that requires index.js at install time. index.js contains a function named syncTelemetry...

Malicious code in chalk-figlet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b package.json declares a postinstall script node example.js that requires index.js at install time. index.js contains a function named syncTelemetry...