EUVD-2022-46938

Malicious code in bioql PyPI...

EUVD-2024-31515

Malicious code in bioql PyPI...

EUVD-2024-42527

Malicious code in bioql PyPI...

CVE-2025-54289

CVE-2025-54289 : Privilege escalation in Canonical LXD

GNU Bash OS Command Injection Vulnerability

GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment...

PT-2026-21991

Name of the Vulnerable Software and Affected Versions Trend Micro Apex One affected versions not specified Description The Trend Micro Apex One management console contains a path traversal weakness. This allows attackers with access to the console to execute malicious code on unpatched Windows...

Linux Distros Unpatched Vulnerability : CVE-2016-6903

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands. CVE-2016-6903 Note that Nessus relies on the...

CVE-2025-55824

ModStartCMS v9.5.0 is affected by an arbitrary file write vulnerability. This flaw enables attackers to write malicious files to the server, which can lead to the execution of malicious commands and the subsequent theft of sensitive data . The vulnerability is associated with CWE-77 (Improper Neu...

Malicious code in octolytics (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5d86b4c4ce77a41bee827eb614c38868e1231feef6629f9baf9cc665e472f530 The OpenSSF Package Analysis project identified 'octolytics' @ 0.19.0 rubygems as malicious. It is considered malicious because: - The package...

Malicious code in pp-react-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 71193da54e6cdc258489d02db5987830a3bc147cbf9b43236f5757cab04f9c73 The OpenSSF Package Analysis project identified 'pp-react-grid' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2025-54762

SS1 Ver.16.0.0.10 and earlier Media version:16.0.0a and earlier allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands with SYSTEM privileges...

CVE-2025-54762

CVE-2025-54762 affects SS1 and its Media version (SS1 Ver.16.0.0.10 and earlier; Media 16.0.0a and earlier). The vulnerability enables a remote, unauthenticated attacker to upload arbitrary files and execute OS commands with SYSTEM privileges. Connected sources additionally map this to multiple S...

MAL-2025-42123 Malicious code in @flight-common/models (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c5af2423bce8f82ab3bebfecba472bdcc04805388481ec19e96c245ca48ccd3b The OpenSSF Package Analysis project identified '@flight-common/models' @ 1.2.9213 npm as malicious. It is considered malicious because: - The...

Malicious code in ng-tds (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b3294da0f9faffb8ba69b152216b52a8aa4ebcf64678bcd336c917b3e054530d The OpenSSF Package Analysis project identified 'ng-tds' @...

Malicious code in api-extractor-lib4-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 659516491da5eda94919af0b09a941720c55632d3a7c3ced84c056da49b4e504 The OpenSSF Package Analysis project identified 'api-extractor-lib4-test' @ 99.0.9 npm as malicious. It is considered malicious because: - The...

CVE-2025-57771: Improper Neutralization of Special Elements used in an OS Command

Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions prior to 3.25.5, Roo-Code fails to properly handle process substitution and single ampersand characters in the command parsing logic for auto-execute commands. If a user has enabled auto-approved execution...

CVE-2025-3128

CVE-2025-3128 affects Mitsubishi Electric smartRTU. A remote unauthenticated attacker can bypass authentication via a specific API route to execute arbitrary OS commands, leading to disclosure, tampering, destruction of data, or DoS. Documents consistently state remote command-injection risk with...

MAL-2025-41427 Malicious code in @navancorp/ta-travel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 475cb3266e9f473c951bb35f87e31b76f08d312ee1916977eb7a125f339f7b7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in catflix (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d0f682b0d66f1100534a823b754c3bc096ac54a5142489698fc5589813699d9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Trend Micro Apex One OS Command Injection Vulnerability

Trend Micro Apex One Management Console on-premise contains an OS command injection vulnerability that could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations...