54715 matches found
CLSA-2026-1777625424 Fix CVE(s): CVE-2026-39881
SECURITY UPDATE: Command injection in netbeans interface - debian/patches/CVE-2026-39881.patch: add nbissafestring in src/netbeans.c and validate typeName, fg and bg in defineAnnoType and key tokens in specialkeys against an allowlist before they reach coloncmd/domap, preventing a malicious...
MAL-2026-3312 Malicious code in path-internal-util (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aaba59a63a7a6f3dfc734a55082dff17dbf357f41b2a09ef0c87f73d046088e1 On require, path.js executes an IIFE that calls loadTokenData, which fetches a base64-obfuscated URL decoding to https://www.jsonkeeper.com/b/CWOV9,...
Malicious code in path-internal-util (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aaba59a63a7a6f3dfc734a55082dff17dbf357f41b2a09ef0c87f73d046088e1 On require, path.js executes an IIFE that calls loadTokenData, which fetches a base64-obfuscated URL decoding to https://www.jsonkeeper.com/b/CWOV9,...
Malicious code in path-addon (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba1a7df799b6bd11bd036f1cfb1de6b1dfe0e4e72082be1b8a60537a59e5ae58 path-addon impersonates the Node.js core path module package name path-addon, README claims to be 'an exact copy of the NodeJS path module'. The body...
Malicious code in bxiucnxcb (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 136aa3924314879404ede1d7153b71b042b3fa55468f0aa1c534e6a18b79e37c During import, the package automatically downloads and executes code that first acts as an infostealer and then starts code acting as a RAT. It connects with a...
MAL-2026-3208 Malicious code in bxiucnxcb (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 136aa3924314879404ede1d7153b71b042b3fa55468f0aa1c534e6a18b79e37c During import, the package automatically downloads and executes code that first acts as an infostealer and then starts code acting as a RAT. It connects with a...
Aver PTC320UV2 命令注入漏洞
The Aver PTC320UV2 is an auto-tracking camera device from Aver Corporation. A command injection vulnerability exists in the Aver PTC320UV2 version 0.1.0000.65, which stems from a command injection vulnerability in the Web management interface that could allow an unauthenticated attacker to execut...
PT-2026-36846
Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.0 Description vm2 is an open source sandbox for Node.js that contains a sandbox breakout issue caused by incorrect code generation management. This allows attackers to bypass JavaScript sandbox isolation and execute...
PT-2026-36847
Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.10.5 Description An insufficient fix in the sandbox implementation allows attackers to bypass security restrictions, enabling them to escape the VM2 sandbox and execute arbitrary commands on the host system. This is...
CVE-2026-37526
CVE-2026-37526 affects AGL app-framework-binder (afb-daemon) up to v19.90.0. The issue arises in the abstract Unix socket @urn:AGL:afs:supervision:socket where the function on_supervision_call dispatches eight supervision commands (Exit, Do, Sclose, Config, Trace, Debug, Token, slist) without any...
CVE-2026-26461
A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated attacker to execute arbitrary commands via a crafted web request...
CVE-2026-26461
A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated attacker to execute arbitrary commands via a crafted web request...
CVE-2026-26461
The Aver PTC320UV2 (an auto-tracking camera device) is affected by a Command Injection vulnerability in its web management interface (version 0.1.0000.65 ). This flaw stems from the improper neutralization of special elements used in a command, which allows an unauthenticated attacker to execute ...
CVE-2026-37526
AGL app-framework-binder afb-daemon through v19.90.0 allows any local process to execute privileged supervision commands Exit, Do, Sclose, Config, Trace, Debug, Token, slist without authentication via the abstract Unix socket @urn:AGL:afs:supervision:socket. The onsupervisioncall function in...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the tcmlooptargetreset function failing to empty executing commands as required by the SCSI EH, which could...
EUVD-2026-26682
AGL app-framework-binder afb-daemon through v19.90.0 allows any local process to execute privileged supervision commands Exit, Do, Sclose, Config, Trace, Debug, Token, slist without authentication via the abstract Unix socket @urn:AGL:afs:supervision:socket. The onsupervisioncall function in...
PT-2026-36529
A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated attacker to execute arbitrary commands via a crafted web request...
CVE-2026-37526
AGL app-framework-binder afb-daemon through v19.90.0 allows any local process to execute privileged supervision commands Exit, Do, Sclose, Config, Trace, Debug, Token, slist without authentication via the abstract Unix socket @urn:AGL:afs:supervision:socket. The onsupervisioncall function in...
CVE-2026-26461: Improper Neutralization of Special Elements used in a Command
A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated attacker to execute arbitrary commands via a crafted web request...
MAL-2026-3206 Malicious code in currentclock (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d1c91399e9fe0c5525eac175fb302553dfca29a3cea2f469e7c9be512629e71c During import, the package automatically downloads and executes code that first acts as an infostealer and then starts code acting as a RAT. It connects with a...