PT-2026-91892

Name of the Vulnerable Software and Affected Versions Octopus Server affected versions not specified Description Incorrect permission validation during script execution allows users with certain scoped permission sets to execute arbitrary scripts on a worker, including the Octopus Server built-in...

ROS-20260915-73-0031

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise data integrity...

CVE-2026-76864: Improper Neutralization of Input During Web Page Generation

NR255-V version 1.5.130703 fails to sanitize QoS rule names before they are parsed via eval in qosxianzaddcgi, qosxianzshowcgi, qosfilteraddcgi, and qosfiltershowcgi handlers. An attacker can inject persistent script code through crafted QoS rule name input that executes when the stored data is...

CVE-2026-76704: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. Successful exploitation could allow an attacker to access...

PT-2026-93201

Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including routing tab add cgi, routing table list show cgi, route policy add cgi, and route policy parame show cgi. Attackers can inject persistent scri...

Ubuntu 16.04 LTS / 18.04 LTS : Yelp vulnerability (USN-8756-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8756-1 advisory. It was discovered that Yelp allowed help documents to execute arbitrary scripts. An attacker could possibly use this issue to trick a user into openin...

CVE-2026-44282: Improper Neutralization of Input During Web Page Generation

Decidim is a participatory democracy framework. Prior to 0.32.0, a low-privilege process-scoped administrator or election editor with question-management rights can store HTML or script-bearing content in question.body. The questiontitle helper returns the translatable question body through...

CVE-2026-53713 Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, toabsolutenormalizedpath in internal/gatewayapi/luavalidator/security.lua does not collapse redundant separators before iscriticalpath evaluates Lua...

CVE-2016-5195

CVE-2016-5195 Copy Fail CVE-2016-5195 The only thing you need is basically the python script...

CVE-2026-19872

A flaw was found in HTML::FormHandler. A remote attacker could exploit this vulnerability by submitting malicious input that is then rendered unescaped in error messages. This allows the attacker to execute arbitrary script code in the victim's browser, potentially leading to information disclosu...

spectre-meltdown-checker v26.36.0913490

Spectre & Meltdown Checker A self-contained shell script to assess your system's resilience against the several transient execution CVEs that were published since early 2018, and give you guidance as to how to mitigate them. CVE list CVE| Name| Aliases ---|---|--- CVE-2017-5753| Bounds Check...

Malicious code in ultra-ws (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3cd852fb9e34a4705cad99a8022db52461e1325daddfa1425df17bbc3b7ac08 package.json declares a dependency node-net-pool whose source is a tarball URL on the main branch of a random third-party GitHub account...

MAL-2026-16148 Malicious code in noblox-asset.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9d897fe6a57fc9f74c5dd46a89603da107c43ad60d3854a86987d67f5702973 noblox-asset.js impersonates the noblox.js Roblox API wrapper: package.json copies the legitimate package's description, homepage...

MAL-2026-16149 Malicious code in os-info-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf3b4f18f9d98ad0792f96d750aef64b390ae6a516d948457d1e78b1d3242ab8 The package's postinstall lifecycle script runs unconditionally on npm install. It collects host identifiers hostname, platform, architecture, kernel...

Malicious code in os-info-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf3b4f18f9d98ad0792f96d750aef64b390ae6a516d948457d1e78b1d3242ab8 The package's postinstall lifecycle script runs unconditionally on npm install. It collects host identifiers hostname, platform, architecture, kernel...

Malicious code in strapi-plugin-os-info-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26da05bb07f15b53c17000d82631f739bcbfed9c94b9b4174e1c3cb769049ce5 The package declares a postinstall script postinstall.js that runs automatically on npm install. The script collects host reconnaissance data —...

MAL-2026-16152 Malicious code in strapi-plugin-os-info-meeb322k (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26da05bb07f15b53c17000d82631f739bcbfed9c94b9b4174e1c3cb769049ce5 The package declares a postinstall script postinstall.js that runs automatically on npm install. The script collects host reconnaissance data —...

Malicious code in web-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61680a5d53758bc9eb99b1cd2566e6e19139d09fee10a0096a5e72bb0953a5b2 package.json declares preinstall: node index.js, causing index.js to execute automatically on npm install. The script collects os.hostname, os.userIn...

MAL-2026-16146 Malicious code in @aiwfm/communitywfm.scripts.api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405cd17e3c682b1341db44361500ea68d80e1758f15387d9971d0af95f0c8a48 The package's preinstall script build.js assembles a remote hostname from split string fragments that resolve to...

Malicious code in @aiwfm/communitywfm.scripts.api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405cd17e3c682b1341db44361500ea68d80e1758f15387d9971d0af95f0c8a48 The package's preinstall script build.js assembles a remote hostname from split string fragments that resolve to...