PT-2026-8056

Name of the Vulnerable Software and Affected Versions directorytree/imapengine versions prior to 1.22.3 Description The software contains a flaw due to improper handling of user-supplied data before it is used in IMAP ID commands within the ImapConnection.php file. Specifically, the id function...

ImapEngine 安全漏洞

ImapEngine is an email management interface developed by DirectoryTree. Versions of ImapEngine prior to 1.22.3 contained security vulnerabilities. These vulnerabilities stemmed from the id function in ImapConnection.php, which had improper handling of user input. This could allow attackers to rea...

CVE-2026-2469: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the id function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands...

CVE-2025-15573

The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud mqtt001.solaxcloud.com, TCP 8883. This allows attackers in a man-in-the-middle position to act as the legitimate MQTT server and issue arbitrary commands to...

Malicious code in displaydoc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c4ab5c0ca76295a578d62119bf6932953098ec9ecd0bb7f21b397da85b08d5b8 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2026-25108

FileZen contains an OS command injection vulnerability. When FileZen Antivirus Check Option is enabled, a logged-in user may send a specially crafted HTTP request to execute an arbitrary OS command...

Soliton Systems Kk FileZen 安全漏洞

Soliton Systems Kk FileZen is a file hosting device developed by the Japanese company Soliton Systems Kk. This device offers functions such as file storage, file transfer, and upload/download capabilities. There is a security vulnerability present in Soliton Systems Kk FileZen; this vulnerability...

PT-2026-7963

Double AsteriskName of the Vulnerable Software and Affected VersionsDouble Asterisk FileZen versions 4.2.1 through 4.2.8 FileZen versions 5.0.0 through 5.0.10 Double AsteriskDescriptionDouble Asterisk FileZen contains an OS command injection vulnerability. When the FileZen Antivirus Check Option ...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the interpolation of untrusted agent metadata into tmux shell command strings executed through /bin/sh -c. An attacker can execute arbitrary commands on the operator host by supplying crafted metadata...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the interpolation of untrusted agent metadata into tmux shell command strings executed through /bin/sh -c. An attacker can execute arbitrary commands on the operator host by supplying crafted metadata...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the interpolation of untrusted agent metadata into tmux shell command strings executed through /bin/sh -c. An attacker can execute arbitrary commands on the operator host by supplying crafted metadata...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the interpolation of untrusted agent metadata into tmux shell command strings executed through /bin/sh -c. An attacker can execute arbitrary commands on the operator host by supplying crafted metadata...

Malicious code in @depro0x/despicable-me (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e512041534d296b22312d733434bb54944a4e026f6ddeaa493240cccc429ee9 The package @depro0x/despicable-me was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in ether-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91fd63bfdad336609f23485d2ef2ac2140053efbfb31aa2bec1811be7139db95 The package ether-lint was found to contain malicious code. Source: ghsa-malware c8e14ef98aaca0dc035a27f9edd6286e29e73d16c2b4e7c98ab1afe1e4740e35 Any...

MAL-2026-941 Malicious code in ether-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91fd63bfdad336609f23485d2ef2ac2140053efbfb31aa2bec1811be7139db95 The package ether-lint was found to contain malicious code. Source: ghsa-malware c8e14ef98aaca0dc035a27f9edd6286e29e73d16c2b4e7c98ab1afe1e4740e35 Any...

CVE-2026-26216 Crawl4AI < 0.8.0 Docker API Unauthenticated Remote Code Execution via Hooks Parameter

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec. The import builtin was included in the allowed builtins, allowing unauthenticated remote...

CVE-2025-15573

The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud mqtt001.solaxcloud.com, TCP 8883. This allows attackers in a man-in-the-middle position to act as the legitimate MQTT server and issue arbitrary commands to...

CVE-2025-15573

The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud mqtt001.solaxcloud.com, TCP 8883. This allows attackers in a man-in-the-middle position to act as the legitimate MQTT server and issue arbitrary commands to...

MAL-2026-946 Malicious code in lala6992 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 03f1d0663411a521e65c618865d7a6e362db8597306c4c8c41d6226292ca7854 The OpenSSF Package Analysis project identified 'lala6992' @ 1.0.0 pypi as malicious. It is considered malicious because: - The package executes...

Malicious code in lala6992 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 03f1d0663411a521e65c618865d7a6e362db8597306c4c8c41d6226292ca7854 The OpenSSF Package Analysis project identified 'lala6992' @ 1.0.0 pypi as malicious. It is considered malicious because: - The package executes...