PT-2026-106004

The convert playwright script prompt in the k6 MCP server accepts a file path as its playwright script argument. Paths given in the documented '@'-prefixed form are restricted to the server's current working directory, but a bare path is resolved by a separate undocumented code path that applies ...

PT-2026-106027

A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting XSS. Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of...

RHEL 7 : rhc-worker-script (RHSA-2026:75689)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:75689 advisory. Remote Host Configuration rhc worker for executing scripts on hosts managed by Red Hat Lightspeed. Security Fixes: encoding/asn1: golang: G...

CVE-2026-104404: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Liquid Web / StellarWP GiveWP give allows Stored XSS.This issue affects GiveWP: from n/a through 4.17.0...

CVE-2026-102576: Improper Neutralization of Input During Web Page Generation

A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting XSS. Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of...

CVE-2026-105649: Improper Neutralization of Input During Web Page Generation

Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file extension were stored without sanitization. This allowed any staff user, including Contributors, to host scripts on the site's domain, possibly resulting in...

PT-2026-106183

Name of the Vulnerable Software and Affected Versions Ghost versions 4.22.0 through 6.64.0 Description SVG media thumbnails and SVG images uploaded with a non-SVG file extension are stored without sanitization. This allows staff users, including those with Contributor roles, to host malicious...

PT-2026-106198

Name of the Vulnerable Software and Affected Versions Ghost versions 6.22.1 through 6.63.0 Description Ghost is a Node.js content management system. When using the default local storage adapter, the system fails to restrict the content type of uploaded files. This allows files uploaded by staff...

CVE-2026-59787: Improper Neutralization of Record Delimiters

The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity...

CVE-2026-105679: Improper Neutralization of Input During Web Page Generation

Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user...

Malicious code in lite-matte (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e7b0ae9e42c334c1c22627e60add7a2c5a0d558a2ab65a3af0043e27bb0e686 package.json declares "postinstall": "wscript.exe 4444.vbs", causing npm install to auto-execute a 765KB Windows Script Host file shipped in the...

MAL-2026-17529 Malicious code in ultimate-websocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7574e423b830695141ee6e089006e0c355109e240c69881512806869cfee8114 package.json declares its only dependency node-net-pool as a bare tarball URL pointing at the mutable main branch of an unrelated GitHub user...

MAL-2026-17498 Malicious code in @kibt/www-nuxt-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ab1895c73507311b9efd31e40015529d9d7735c87e50cf3b714e6e520205ec4 The package is a stub whose index.js exports a Proxy returning no-op functions for every property access, allowing bundlers that import any member of...

Malicious code in @angulra/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ebb04f93b463536e56e0160e0e1fc2748d69c9eb15f991e990365cee7852a34 The package.json preinstall script runs curl -L...

MAL-2026-17496 Malicious code in @angulra/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ebb04f93b463536e56e0160e0e1fc2748d69c9eb15f991e990365cee7852a34 The package.json preinstall script runs curl -L...

Malicious code in @angulra/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3158beab2ea0d9f8e28d488f124268c8c9a00a3a0f5599823c4d13f741ac40f The package name @angulra/cli is a character-swap of @angular/cli and copies the legitimate Angular CLI's metadata description, repository, homepage,...

MAL-2026-17495 Malicious code in @angulra/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3158beab2ea0d9f8e28d488f124268c8c9a00a3a0f5599823c4d13f741ac40f The package name @angulra/cli is a character-swap of @angular/cli and copies the legitimate Angular CLI's metadata description, repository, homepage,...

metasploitable2-red-team-assessment

Red Team Assessment — Metasploitable 2 Type: Authorized P...

Malicious code in anthropic-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 500869e36b3f76202b63e8db9087adcfc42c8281a27a4402a21285aabde7a511 The package publishes as anthropic-sdk and re-exports the official anthropic client's symbols from anthropic import ; re-exports of...

MAL-2026-17472 Malicious code in anthropic-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 500869e36b3f76202b63e8db9087adcfc42c8281a27a4402a21285aabde7a511 The package publishes as anthropic-sdk and re-exports the official anthropic client's symbols from anthropic import ; re-exports of...