MAL-2026-15893 Malicious code in sliding-score-window (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82e2a97d5dd3e10080ee69201bf757ea14ebda90b9da1be41392584152ad1f1d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-66324

External control of file name or path in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

MAL-2026-14605 Malicious code in 3layerdipstack1lkqg9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3055362817a22386f2c0e5db959db42444b9c60d620c9c8453ee196a1d0e8fe The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack1ykdgn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eabe62f28af88a694847d251ec0545bcdfe498e5bf37df3e5d32552bfd10aae3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14624 Malicious code in 3layerdipstack4iivta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4d3d58aee204e2100f687789f6a289319f32965af1e8dd324767d40be1b36d0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackjnh4m1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbafb2120a0c1a9e305f4904a3c753b097417bf2d6ac4348ca6ff493649b0d55 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Microsoft Edge (Chromium-based) Spoofing Vulnerability

External control of file name or path in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

MAL-2026-14577 Malicious code in hydration-ui-dlx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e76afa004355ba53a89056c6daff511bb4f41e2bd666e2a5592d033e079e5740 The package's main module contains a top-level IIFE that chmods 0o755 and detached-spawns dist/internal/math-calc.mjs, which is a Linux x8664 ELF...

CVE-2026-76158 Datiphy Data Management Center - External Control of File Name or Path

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences...

CVE-2026-76158

Datiphy Data Management Center (v8.3.0 through v8.5.1) contains a path traversal vulnerability in its upload API endpoint. An unauthenticated remote attacker can supply relative or absolute path sequences to write files to arbitrary locations outside the intended upload directory, enabling arbitr...

CVE-2025-36398

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to read or modify another user's command history due to an externally controlled filename...

CVE-2026-20358 Cisco Crosswork Security Hardening Release: August 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

PT-2026-76966

Name of the Vulnerable Software and Affected Versions Citrix WorkSpace App version 2607 Description An issue exists in Citrix WorkSpace App on MacOS that allows external control of a file name or path. This occurs when the application does not properly validate the file path provided by an extern...

CVE-2026-34492

External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...

CVE-2026-16708

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration...

CVE-2026-34492

External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...

CVE-2026-17184

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are affected by CVE-2026-17184, enabling a remote attacker to execute arbitrary code due to external control of a file name or path. The issue affects the GUI and related components of IBM Db2 Mirror for i. IBM’s bulletin lists remediation via platf...

CVE-2026-16708

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration...

CVE-2026-18127

CVE-2026-18127 affects Ivanti Endpoint Manager core prior to 2024 SU7. An authenticated, network-accessible attacker can externally control a filename in the Core, enabling full write access to an S3 bucket used for session-recording storage. The CVSS score is 7.7 (HIGH); attack requires low priv...

EUVD-2026-56157

External control of a filename in the Core of Ivanti Endpoint Manager before version 2024 SU7 allows a remote authenticated attacker full write control over an S3 bucket configured for session recording storage...