CVE-2026-80412 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation...

EUVD-2026-85672

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation...

CVE-2026-80412

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to remote code execution due to improper escaping of connector property values during OSH script generation. A remote authenticated attacker could exploit this flaw to execute arbitrary code. No specific exploit details or remediation step...

CVE-2026-80412 DataStage on Cloud Pak for Data has several vulnerabilities

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper escaping of connector property values during OSH script generation...

MAL-2026-16480 Malicious code in a-onesite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b1ed6ca931448c083b5356eae6ad5af3cce9011d70fce4ce4ad427349991856 [email protected] ships an empty index.js and no library functionality. Its package.json declares preinstall, preupdate, and test scripts that all...

Malicious code in a-onesite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b1ed6ca931448c083b5356eae6ad5af3cce9011d70fce4ce4ad427349991856 [email protected] ships an empty index.js and no library functionality. Its package.json declares preinstall, preupdate, and test scripts that all...

CVE-2026-95626

Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is presen...

EUVD-2026-85177

Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is presen...

CVE-2026-95626

The Tauri framework v2 contains a vulnerability where its Content Security Policy (CSP) hardening is ineffective against specific URI schemes. While Tauri injects a random nonce to restrict script execution, the CSP Level 3 specification allows data: and blob: schemes to remain active even when a...

MAL-2026-16474 Malicious code in vite-dev-launcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ac504b2228b7e2d5aab05aac8cb13072d87bc4f047f390d207c7712c7cdd123 The package presents as a Vite dev-server wrapper but its declared postinstall node./postinstall-run.cjs chains through...

CVE-2026-91798

A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges...

CVE-2026-91798 Foxit PDF Editor/Reader Updater Privilege Escalation

A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges...

EUVD-2026-85167

A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges...

CVE-2026-91798 Foxit PDF Editor/Reader Updater Privilege Escalation

A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader due to an insecure permission configuration that allows the configuration file to be modified by regular users, which may lead to arbitrary script execution with higher privileges...

CVE-2026-91798

A local privilege escalation vulnerability exists in the update daemon of Foxit PDF Editor/Reader . The flaw is caused by an insecure permission configuration that allows regular users to modify the configuration file. This vulnerability could lead to arbitrary script execution with higher privil...

CVE-2026-5924

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps block's 'customStyle' attribute in all versions up to, and including, 2.1.3. This is due to the use of eval on user-controlled block content in the frontend JavaScript mapStyles...

CVE-2025-15696

The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the...

MAL-2026-16462 Malicious code in godzz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b5d71d42ffa8a11d58cf5bf2cf8eab5f95e14d047f0907b6e0581a3c33ea299 On module load, godzz sets process.env.NODETLSREJECTUNAUTHORIZED='0', disabling TLS certificate validation for the entire Node process. Its main entr...

MAL-2026-16445 Malicious code in n8n-nodes-metricsagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...

Malicious code in n8n-nodes-metricsagent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c0f8f773e26111905993b9bded9babe49611349bbe3ea18d32da0c22692f65f The package declares a postinstall lifecycle script package.json scripts.postinstall = 'node postinstall.js || true' that requires./index.js and...