Malicious code in leocare-new (npm)

Source: ossf-package-analysis 311899bcdd83d3cd308268641290fc8fd0f503d308fc1bbf7488b5f0fab734cb The OpenSSF Package Analysis project identified 'leocare-new' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. -...

Command Injection

Overview @cyclonedx/cyclonedx-npm is a Create CycloneDX Software Bill of Materials SBOM from NPM projects. Affected versions of this package are vulnerable to Command Injection via the --workspace argument on Windows systems. An attacker can execute arbitrary operating system commands by supplyin...

PT-2026-94576

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the nvmet execute identify ns zns function. This happens when a host sends an Identify command with CNS 05h and CSI 02h ZNS targeting a file-backed...

PT-2026-94760

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nvmet execute get log page rmi function where the status variable retains a success value NVME SC SUCCESS even when kzalloc fails to allocate the log buffer. This...

CVE-2026-92128

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier downloads a JAR file specified by URL twice, confirming the approval of the first download and loading the classpath entries from the second, allowing attackers able to define classpath entries to execute arbitrary code in the context ...

CVE-2026-16794 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected...

PT-2026-93868

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An issue exists in the internal configuration of the Apache JServ Protocol AJP connector. This is caused by the incorrect initialization of encryption parameters for the AJP...

CVE-2026-57138

PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, codeMode in src/praisonai-ts/src/tools/builtins/code-mode.ts executes untrusted JavaScript with new Function inside withsandbox and relies on a small source-code blocklist plus shadowed process and require properties. Code can use...

Astra Linux – Vulnerability in PostgresSQL 11

schemaelement defeats protective measures for search paths; It was discovered that certain database calls in PostgreSQL could allow an authenticated attacker with elevated database-level privileges to execute arbitrary code...

CVE-2026-90619

A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrikeserver.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os command injection. It is possible to...

EUVD-2026-77178

A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrikeserver.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os command injection. It is possible to...

CVE-2026-90619 0x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injection

A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrikeserver.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os command injection. It is possible to...

CVE-2026-90619 0x4m4 HexStrike AI Execute Endpoint hexstrike_server.py os command injection

A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrikeserver.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os command injection. It is possible to...

CVE-2026-90619

0x4m4 HexStrike AI (up to commit d689933ff579d839c676c82b231f8e98326c5f04 ) is affected by an OS command injection in the Execute Endpoint of the file hexstrike_server.py . An unauthenticated remote attacker can manipulate the code/script argument to inject arbitrary OS commands. The proof-of-con...

CVE-2026-90619: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrikeserver.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os command injection. It is possible to...

PT-2026-91033

A vulnerability has been found in 0x4m4 HexStrike AI up to d689933ff579d839c676c82b231f8e98326c5f04. Impacted is an unknown function of the file hexstrike server.py of the component Execute Endpoint. The manipulation of the argument code/script leads to os command injection. It is possible to...

Malicious code in interface-stack-mock-execute-log (npm)

Source: amazon-inspector cc20e53d07d6acddd739f4e433e4d8a4bb9b9679bbf5027a87b77495cb36177b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in integer-execute-shell-runtime-protected (npm)

The package integer-execute-shell-runtime-protected was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in integer-bad-socket-execute-emulate (npm)

The package integer-bad-socket-execute-emulate was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in hyrule-react-commons (npm)

Source: ossf-package-analysis 3b82bec5139c178e3b425e5e458a9c7b248b17db5192cf6178702cbb26822dba The OpenSSF Package Analysis project identified 'hyrule-react-commons' @ 2.0.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...