122586 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-102831
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.5.0 until 4.5....
Linux Distros Unpatched Vulnerability : CVE-2026-97711
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values...
PT-2026-103069
A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser...
CentOS Linux 7 [TuxCare] Security Update: ctdb / ctdb-tests / libsmbclient / libsmbclient-devel / libwbclient / etc (CENTOS7:CLSA-2026:1782977299)
The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1782977299 advisory. - A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the...
AlmaLinux 9.2 [TuxCare] Security Update: ctdb / libnetapi / libnetapi-devel / libsmbclient / etc (ALMALINUX9.2:CLSA-2026:1782204526)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1782204526 advisory. - A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use t...
Malicious code in test-agency-assignment-02 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9944ea8ca21c0670c4b718a12427e8ca7330571ef5a9198a60b05f75038fe73 The tarball contains only package.json and 4444.vbs; the declared main entry index.js is absent. package.json defines a postinstall script wscript.ex...
MAL-2026-17297 Malicious code in test-agency-assignment-02 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9944ea8ca21c0670c4b718a12427e8ca7330571ef5a9198a60b05f75038fe73 The tarball contains only package.json and 4444.vbs; the declared main entry index.js is absent. package.json defines a postinstall script wscript.ex...
Malicious code in test-agency-assign (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e650e815b4409c3c07cdab7c953ed69b8052f32a28c3686397ab362bb1bd4552 [email protected] declares a package.json postinstall script wscript.exe Kelimasow.exe that auto-executes a bundled 8.4 MB Go-compiled Windows...
MAL-2026-17295 Malicious code in test-agency-assign (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e650e815b4409c3c07cdab7c953ed69b8052f32a28c3686397ab362bb1bd4552 [email protected] declares a package.json postinstall script wscript.exe Kelimasow.exe that auto-executes a bundled 8.4 MB Go-compiled Windows...
CVE-2026-69662
The application uses unsafe functions that allow execution of inline scripts and string evaluation functions...
Malicious code in @rutxploit-sec/subsplash-google-tag-manager (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fe2c746dc5c09bc67257fd4eba671824806c9080b7ca94949e45175deb03b8d package.json declares a preinstall script that executes inline Node code reading os.hostname and os.userInfo.username and issuing an HTTP GET to...
MAL-2026-17289 Malicious code in @rutxploit-sec/subsplash-google-tag-manager (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fe2c746dc5c09bc67257fd4eba671824806c9080b7ca94949e45175deb03b8d package.json declares a preinstall script that executes inline Node code reading os.hostname and os.userInfo.username and issuing an HTTP GET to...
Malicious code in @rutxploit-sec/subsplash-canny (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1ebadea2eb63a0fc7cf7446e36a589c5b87fc7d28e68b68145b98577107ebb npm package @rutxploit-sec/subsplash-canny declares a preinstall lifecycle script that runs node -e inline code reading os.hostname and...
MAL-2026-17288 Malicious code in @rutxploit-sec/subsplash-canny (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1ebadea2eb63a0fc7cf7446e36a589c5b87fc7d28e68b68145b98577107ebb npm package @rutxploit-sec/subsplash-canny declares a preinstall lifecycle script that runs node -e inline code reading os.hostname and...
MAL-2026-17290 Malicious code in @rutxploit-sec/waves-button-poc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 435937e521ca52ff4d99fd276136aff40364c4a88a3a4677cecf390c9d9bb600 @rutxploit-sec/[email protected] auto-executes host-identifier exfiltration on both npm install and require. package.json declares a preinstall...
AZL-105675 CVE-2026-102925 affecting package python-virtualenv 20.36.1-6
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...
UBUNTU-CVE-2026-102925
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate bash and zsh and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path...
Cross-site Scripting (XSS)
Overview @jupyterlab/apputils is a JupyterLab - Application Utilities Affected versions of this package are vulnerable to Cross-site Scripting XSS via the notebook paste action in packages/notebook/src/actions.tsx, which does not validate whether clipboard data originated from within the...
DEBIAN-CVE-2026-102875
VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...
CVE-2026-102875
VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...