Malicious Package

Overview easypanel-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview box-sign-client-poc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ejs-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview box-sign-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview egstore-graphql-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious code in easypanel-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1675d70b09ce1f826b69fbfcee3cf56a81c49c37fa4fb4bdafd4f72b736880f8 The package's npm preinstall hook collects the installer's hostname, OS username, current working directory, and CI-related environment variable name...

MAL-2026-15896 Malicious code in easypanel-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1675d70b09ce1f826b69fbfcee3cf56a81c49c37fa4fb4bdafd4f72b736880f8 The package's npm preinstall hook collects the installer's hostname, OS username, current working directory, and CI-related environment variable name...

kernel: smb/client: fix out-of-bounds read in symlink_data()

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability arises from insufficient length validation in the smb2checkmessage function when processing symlink error responses. A remote attacker could exploit this by sending a specially crafted symlink error respons...

kernel: smb: client: fix query directory replay double-free

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error, occurs when the client attempts to free the same memory buffer twice during a directory query operation. An attacker could potentially exploit this flaw to cause memory corruption,...

Malicious code in mcp-consultasdeveiculos-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb4363d5425f97beac0872e7e266983ebf4734da51c66ff674227108762c762c Package bin/main script, invoked as npx -y mcp-consultasdeveiculos-client --token per the referenced upstream project's public instructions, reads...

MAL-2026-15869 Malicious code in mcp-consultasdeveiculos-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb4363d5425f97beac0872e7e266983ebf4734da51c66ff674227108762c762c Package bin/main script, invoked as npx -y mcp-consultasdeveiculos-client --token per the referenced upstream project's public instructions, reads...

EUVD-2026-70814

MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters into client names to execute arbitrary commands as the uMemWatch process user through unquoted redirection targets in system calls...

CVE-2026-80888: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dmabuf reference on foreign-fd prime import ttmprimefdtohandle returns -ENOSYS when the imported fd's dmabuf-ops do not match the ttmobjectdevice's ops, but does so without releasing the reference acquired by...

PT-2026-85579

Name of the Vulnerable Software and Affected Versions Chatbot UI affected versions not specified Description An authorization bypass exists in the retrieval endpoint. Authenticated attackers can access private file content of other users by providing arbitrary file UUIDs. The issue occurs because...

Dear Flipbook < 2.4.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute

Description The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent class attribute of .dvcss element' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization...

PT-2026-85519

GFI Exinda AI before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The web tools cmd function constructs an iperf command using the server and options parameters without sanitization, permitting injection of arbitrary iperf flags. An authenticated...

CVE-2026-75925: Improper Neutralization of CRLF Sequences

Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM. Configuration values accepted by the local service are written to a file later consumed by a privileged subprocess, without line-ending sequences being...

CVE-2026-74237: Improper Neutralization of Argument Delimiters in a Command

GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The webtoolscmd function constructs an iperf command using the server and options parameters without sanitization, permitting injection of arbitrary iperf flags. An...

CVE-2026-85693: Authorization Bypass Through User-Controlled Key

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

CVE-2026-19283: Incorrect Authorization

IBM Observability with Instana Agent Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system...