CVE-2026-18736

Technical details about CVE-2026-18736 are not publicly available in the provided documents. Monitor for updates for affected products, versions, impact specifics, and remediation guidance.

CVE-2026-39931 OpenEMR Authenticated SQL Injection via backup.php Import Feature

OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database by uploading a crafted SQL file at the...

EUVD-2026-52169

The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection and extract data from the database...

T24 Web Server - Local File Inclusion

T24 web server is vulnerable to unauthenticated local file inclusion that permits an attacker to exfiltrate data directly from server. id: CVE-2019-14251 info: name: T24 Web Server - Local File Inclusion author: 0xAkoko severity: high description: T24 web server is vulnerable to unauthenticated...

CVE-2026-65321

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format, which routes DELETE and CTAS statements to the escapehive function that backslash-escapes single...

CVE-2026-65321 PyAthena SQL Injection via DefaultParameterFormatter DELETE/CTAS

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format, which routes DELETE and CTAS statements to the escapehive function that backslash-escapes single...

MAL-2026-11428 Malicious code in wacve-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 de96a68d25555c9ee1792a22b84307ba3bc68d1e012bd841454dc775986260cb The package contains encrypted code with infostealers targeting Linux and Android execution under Termux. The encrypted code collects files, browsers data, tex...

Malicious code in wacve-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 de96a68d25555c9ee1792a22b84307ba3bc68d1e012bd841454dc775986260cb The package contains encrypted code with infostealers targeting Linux and Android execution under Termux. The encrypted code collects files, browsers data, tex...

EUVD-2026-51826

axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with httpVersion: 2. Because Node's HTTP/2 request API does not honor the maxBodyLength option and axios's byte-counting stream wrapper is gated on...

EUVD-2026-51696

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. Th...

MAL-2026-11417 Malicious code in aiprepkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7a5376398cb81f79bf581819bf1f7fad54a6e3feaaa7ded6d3b418d4562c47d5 In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

MAL-2026-11416 Malicious code in ailaunchkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a11e86f01cbd23fcc0453904b7991ddaaf87582fde3bcc3b48686a28213c46d9 In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

MAL-2026-11420 Malicious code in walmart-genai-trace (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7e84b4bbb5660ea5c7f803c4e5d0b12dfe41c9bb147fd2228c72bdda2224291a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-11418 Malicious code in catalogai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ebd7348ccf6d30158d05df90e15ebba938c30119c83b2ce6679cd69068dc667b In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

MAL-2026-11419 Malicious code in cognikit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e0cdc137d19f19df47efa6fae6d52ec6eda48eb2f1915ac4eb77787956d10aba In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

MAL-2026-11414 Malicious code in aiassistcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f2900cfaae06740bbefca375a4d23cb6c3dd67726ace0f9cffda92c04f1c4333 In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

MAL-2026-11415 Malicious code in aichannel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 21e18e6e4016bf07f11edb272a08fb26268b2fbfe0b42a4ba502df368ce05b01 In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

GeoServer WFS - XXE Processing Vulnerability

GeoServer Web Feature Service WFS is vulnerable to an XML External Entity XXE processing attack due to improper handling of XML input. This vulnerability allows attackers to perform Out-of-Band OOB data exfiltration and Server-Side Request Forgery SSRF by exploiting the GeoTools library. id:...

MAL-2026-11201 Malicious code in ml-nps-shared (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fed6e01148ede73fae9d01667807eb310434a9c801b9eb60f08141e34921fc85 During installation, package exfiltrates basic info and all environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-11202 Malicious code in ml-shared (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4f4ae8fee891c54953efa7c796a605e700fc827131feff0243f0b3bc8bd6a260 During installation, package exfiltrates basic info and all environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...