Malicious code in permit2 (npm)

permit2 is a malicious npm package that squats the bare name of Uniswap's Permit2 token-approval system whose legitimate npm distribution is the scoped @uniswap/permit2-sdk, advertising itself as a "smart contract development toolkit." The package contains no real functionality — the published...

CVE-2026-72590

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

EUVD-2026-55216

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

CVE-2026-72590 alseambusher crontab-ui - Unauthenticated RCE via Newline Injection in env_vars Parameter

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET request to /crontab with URL-encoded newlines in the envvars parameter...

Astra Linux – Vulnerability in Python 3.11

If the value passed to os.path.expandvars is controlled by the user, there is a possibility of performance degradation when expanding environment variables...

Linux Environment Variable Enumeration

Enumerates environment variables at the SYSTEM and USER scope on Linux. SYSTEM-scope variables are collected from /etc/environment, /etc/security/pamenv.conf, /usr/share/pam/security/pamenv.conf and shell scripts under /etc/profile.d/ plus /etc/profile and /etc/bashrc. USER-scope variables are...

MAL-2026-13666 Malicious code in cubesat-upstream-driver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f5f2cf32e29ec0daedda5112ca2c560e69b4c4cd77850d6dc52d7a448e343a2 The package is advertised as an 'Upstream driver interface for cubesat orbital command bus' but ships no driver, protocol, or telemetry code. Its sol...

Malicious code in cubesat-upstream-driver (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f5f2cf32e29ec0daedda5112ca2c560e69b4c4cd77850d6dc52d7a448e343a2 The package is advertised as an 'Upstream driver interface for cubesat orbital command bus' but ships no driver, protocol, or telemetry code. Its sol...

MAL-2026-13559 Malicious code in dolyame-ui-collapseblock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef9992e81f3de4cb9bd4391466d7850e953c19a0772ebbe5992953044466377c On require, shim.js fetches an OS/architecture-specific native binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...

Exposure of Resource to Wrong Sphere

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere via the elementId parameter, which allows interpolation of environment variables and secrets into a Twig template even when the Twig sandbox is enabled. A...

GHSA-596P-6JV8-775V Craft CMS: Authenticated leak of secret environment variables

Environment variables and secrets are interpolated into a Twig template even when the Twig sandbox is enabled, allowing them to be leaked by an authenticated attacker. The Craft vulnerability CVE-2026-31857 was only patched by applying sandboxed Twig templating. This theoretically protects Craft...

EUVD-2026-53936

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...

CVE-2026-53976 OpenChamber 1.11.7 Path Traversal File Read via allowOutsideWorkspace Parameter

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...

CVE-2026-66297

Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...

CVE-2026-66297 Unescaped deployment environment variables in generated setup commands

Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...

CVE-2026-10128

IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated users can exploit a built-in Langflow component to read arbitrary server environment variables, exposing sensitive secrets despite security controls intended to disable custom components...

CVE-2026-10128

IBM Langflow OSS 1.0.0 through 1.10.3 allows authenticated users can exploit a built-in Langflow component to read arbitrary server environment variables, exposing sensitive secrets despite security controls intended to disable custom components...

Malicious code in eth-account-wallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc3337915e7c14a0ceb6743d1edf2e607fd7926656b49cdd041d7b161b718178 eth-account-wallet 0.11.2 is a typosquat of the eth-account PyPI package. Its setup.py installs a custom install cmdclass PI that, on pip install,...

MAL-2026-13372 Malicious code in eth-account-wallet (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc3337915e7c14a0ceb6743d1edf2e607fd7926656b49cdd041d7b161b718178 eth-account-wallet 0.11.2 is a typosquat of the eth-account PyPI package. Its setup.py installs a custom install cmdclass PI that, on pip install,...

MAL-2026-13362 Malicious code in mnemonic-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6599d6208d71e0e809661e86bf5641e6e7b871cd6f01a54abf22215b8a88ef11 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category:...