MAL-2026-10730 Malicious code in codeam-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e8b39baa6129e1e1988002fcbeb2f62464f84fc7458f82f3754d1033a9b4ca6 codeam-cli spawns a node-pty pseudo-terminal wrapping the local Claude Code / Codex agent process and connects outbound over WebSocket to a hardcoded...

MAL-2026-10757 Malicious code in dde-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f875cacd68379cbaaa066adac089dc3c403fd532a0e73ba932cf35e0562ff476 setup.py installs a telemetry.pth file into site-packages containing import telemetryinit, which causes Python's site.py to load the bootstrap module...

CVE-2026-44595

Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one...

CVE-2026-6511

During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for Windows that could allow a local authenticated user to access files owned by a different user on the same system...

EUVD-2026-44974

During an internal security assessment, a potential improper access control vulnerability was discovered in Lenovo Smart Connect for Windows that could allow a local authenticated user to access files owned by a different user on the same system...

CVE-2026-6511

CVE-2026-6511 : Lenovo Smart Connect for Windows is reported to have an improper access control vulnerability that could allow a local authenticated user to access files owned by another user on the same system. The issue is described as local, with low attack complexity and the attack requires l...

CVE-2026-9292

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:41+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-09...

CVE-2026-15352

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:39+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-03 2026-07-16 23:23:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsewl6cyb2e 2026-07-30 23:00:46+00:00| seen|...

CVE-2026-8314

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:36+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-01 2026-07-21 09:01:06+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr5h3pkxqd23 2026-07-21 09:01:17+00:00| seen|...

CVE-2026-8313

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:34+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-01 2026-07-21 08:30:42+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr5ffdinfx2p 2026-07-21 08:30:43+00:00| seen|...

CVE-2026-12659

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:28+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-08...

CVE-2026-11889

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:25+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-07...

CVE-2026-57896

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:19+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04...

CVE-2026-60140

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:16+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04...

CVE-2026-61389

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:14+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04...

CVE-2026-60063

creationtimestamp| type| source ---|---|--- 2026-07-16 16:15:12+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-197-04...

EUVD-2026-44960

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the...

CVE-2026-55548

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the...

CVE-2026-55548

In Yamcs, CVE-2026-55548 affects the PacketsApi.exportPackets endpoint. The root cause was failure to enforce per-packet ReadPacket privileges when a request supplied an empty packet-name list, causing no WHERE pname IN filter and the onTuple handler to stream packets without per-row authorizatio...

CVE-2026-63082

Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with Agent-level privileges to manipulate the Support Agent assignment field of tickets by bypassing intended authorization checks. Attackers can a...