Malicious code in ts-utility-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75e338acac1218e74bb44a4141ac9eb195da36f48eef6f4b1d11c84fe92a96ef The package's default export getPlugin performs an HTTPS request to a hardcoded bare-IP endpoint at https://31.97.137.157:45000/icons/109 and passes...

CVE-2026-19208

A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD::queryTrades of the file src/TraderDD/TraderDD.cpp. The manipulation of the argument FIDJYLB results in enforcement of behavioral workflow. The attack can be launched remotely. A high complexity level is...

CVE-2026-15816 Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...

CVE-2026-15816

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...

CVE-2026-54209

The CVE-2026-54209 entry concerns Tobit Laboratories AG TeamDavid’s Webbox. A buffer overflow can occur in the editini path handling when the user writes to Archive.ini without verifying the target file. The vulnerability arises if an attacker specifies a different large file, triggering overflow...

CVE-2026-54209 TeamDavid: Buffer Overflow in 'editini' function

Tobit Laboratories AG TeamDavid's Webbox application handles password changes using a function triggered by including the string "editini" in the file path, writing the new password to the specified "Archive.ini" file. However, the application does not verify that the provided path actually refer...

CVE-2026-54209 TeamDavid: Buffer Overflow in 'editini' function

Tobit Laboratories AG TeamDavid's Webbox application handles password changes using a function triggered by including the string "editini" in the file path, writing the new password to the specified "Archive.ini" file. However, the application does not verify that the provided path actually refer...

CVE-2026-54206

CVE-2026-54206 affects Tobit Laboratories AG TeamDavid’s Webbox. The issue is a server-side inclusion/SSRF via the pathname parameter in the sending functionality, which can be set to UNC paths (e.g., \Server\Share). The server processes these paths without validation, causing outbound connection...

CVE-2026-54206 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in sending functionality

Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

CVE-2026-49008

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device...

Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()

...

EUVD-2026-54412

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability...

CVE-2026-66491

Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability...

CVE-2026-49008

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device...

CVE-2026-49008 Integrity‑check credential leakage vulnerability in an application function of ZTE F689 product

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device...

EUVD-2026-54410

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device...

CVE-2026-49008 Integrity‑check credential leakage vulnerability in an application function of ZTE F689 product

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device...

CVE-2026-19196

CVE-2026-19196 affects SourceCodester Photo Share Website 1.0. The vulnerable element is the unknown function in the file /social/ajax.php?action=login , where manipulation of the email parameter leads to a SQL injection . The attack can be launched remotely and the exploit has been publicly disc...

EUVD-2026-54325

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-54294

A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.2. This affects the function read of the file metagpt/tools/libs/editor.py. This manipulation causes path traversal. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The vendo...