Important: Red Hat Security Advisory: freerdp security update

An update for freerdp is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure

A flaw was found in FreeRDP. An uninitialized heap memory disclosure vulnerability exists in the urbdrc USB redirection channel. A malicious Remote Desktop Protocol RDP server can exploit this by inducing failing USB transfers, allowing it to read uninitialized heap memory from the client. This...

CVE-2023-23752

CVE-2023-23752 - Reaparición de la vulnerabilidad de acceso no autorizado de Joomla Uso del script Instalar la biblioteca de python pip install -r requirements.txt Verificación de vulnerabilidad python3 CVE-2022-26134check.py -u url -c whoami Escaneo por lotes python3 CVE-2023-23752.py -f...

MAL-2026-17547 Malicious code in css-at-scope-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4d8d974b7fabf04fa662971cd8041fb76775bf5ed2902cbbffed0f881e2036d Package is published under a CSS-polyfill name but ships thunderboltRegistry.js, which exports Wix internal registry module names thunderboltRegistry...

Malicious code in css-at-scope-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4d8d974b7fabf04fa662971cd8041fb76775bf5ed2902cbbffed0f881e2036d Package is published under a CSS-polyfill name but ships thunderboltRegistry.js, which exports Wix internal registry module names thunderboltRegistry...

Malicious code in css-svqggc-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b23cf39720388bcf9f26621bd52e256e18a011bf3b6821b7d9f5f60115b9663 Package masquerades as a CSS polyfill while impersonating internal Wix Thunderbolt registry modules thunderboltRegistry, siteAssetsRegistry,...

Malicious code in css-ikomdq-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 255cceca3ca8631c9b225745c5b64a71fd6c09b60fa3ad95b419fccb66f035f2 The package presents itself as a CSS polyfill but ships thunderboltRegistry.js, which on require executes a top-level IIFE that runs id, whoami, unam...

MAL-2026-17553 Malicious code in css-ikomdq-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 255cceca3ca8631c9b225745c5b64a71fd6c09b60fa3ad95b419fccb66f035f2 The package presents itself as a CSS polyfill but ships thunderboltRegistry.js, which on require executes a top-level IIFE that runs id, whoami, unam...

Malicious code in css-ogojwh-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aff543635c832e0563229f42fcc7673c835f2ba5a9ae41d680aa572cfba49765 [email protected] presents itself as a CSS polyfill but ships thunderboltRegistry.js which, on require, runs an IIFE that executes shell...

Malicious code in css-nbanqq-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7377a70c94f8fd1719147b2023860926935a70410f672e07411326284f11a69f The package impersonates Wix thunderbolt internal registry modules exporting thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry,...

MAL-2026-17555 Malicious code in css-nbanqq-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7377a70c94f8fd1719147b2023860926935a70410f672e07411326284f11a69f The package impersonates Wix thunderbolt internal registry modules exporting thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry,...

MAL-2026-17561 Malicious code in insomnia-plugin-api-lint-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3572e41f2e2e83a3156c1b24bf8684c0149a508e45626e80c592657cfb475ba index.js, the package's main entry, runs at require time with no user interaction. On load it spawns OS-native calculator processes via...

Malicious code in insomnia-plugin-api-lint-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3572e41f2e2e83a3156c1b24bf8684c0149a508e45626e80c592657cfb475ba index.js, the package's main entry, runs at require time with no user interaction. On load it spawns OS-native calculator processes via...

MAL-2026-17545 Malicious code in abbishal-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d3f60fb75143a3cdfedea0c2f185e0556053cd458cd5e76cd5303bf406eb32 On npm install, package.json's preinstall hook runs sh./test.sh, which uses character-split variable obfuscation b=e, i=c, s=n, h=u, a=v, l=rl to...

Malicious code in tostpro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b31f6e946441400814984e1285717f9b2ee7fe5dacb7f0433f89396648a6183 The npm package [email protected] ships a preinstall lifecycle hook that invokes test.sh, which runs automatically on npm install. The script assembles...

MAL-2026-17564 Malicious code in tostpro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b31f6e946441400814984e1285717f9b2ee7fe5dacb7f0433f89396648a6183 The npm package [email protected] ships a preinstall lifecycle hook that invokes test.sh, which runs automatically on npm install. The script assembles...

MAL-2026-17543 Malicious code in @inpeek/odata-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 914508dbfa95a3d2cef5aef321a656215797f477c161a8c234e76256db6cac65 @inpeek/[email protected] is a dependency-confusion squat on the private @inpeek scope, published to the public npm registry at an inflated...

Malicious code in @inpeek/odata-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 914508dbfa95a3d2cef5aef321a656215797f477c161a8c234e76256db6cac65 @inpeek/[email protected] is a dependency-confusion squat on the private @inpeek scope, published to the public npm registry at an inflated...

CVE-2026-20543

In Modem, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01645293; Issue ID: MSV-6761...

CVE-2026-20528

In ccci, there is a possible out of bounds write and read due to a missing bounds check. This could lead to local information disclosure, memory corruption, crashes, or privilege escalation if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation...