EUVD-2026-5044

An input neutralization vulnerability in the File Operations API Endpoint component of Crafty Controller allows a remote, authenticated attacker to perform file tampering and remote code execution via path traversal...

PT-2026-5380

Name of the Vulnerable Software and Affected Versions Crafty Controller affected versions not specified Description An input neutralization weakness exists in the Backup Configuration component of Crafty Controller. A remote, authenticated attacker can exploit this to tamper with files and execut...

GHSA-562R-8445-54R2 ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler

Impact Vulnerability Type: CRLF Injection via ConfigParser An attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead to security setting tampering or modification of application behavior. Affected Users: Users...

CVE-2026-22777 ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler

ComfyUI-Manager is an extension designed to enhance the usability of ComfyUI. Prior to versions 3.39.2 and 4.0.5, an attacker can inject special characters into HTTP query parameters to add arbitrary configuration values to the config.ini file. This can lead to security setting tampering or...

CVE-2021-22488

There is an Unauthorized file access vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability by modifying soft links may tamper with the files restored from backups...

CVE-2017-12778

The UI Lock feature in qBittorrent version 3.3.15 is vulnerable to Authentication Bypass, which allows Attack to gain unauthorized access to qBittorrent functions by tampering the affected flag value of the config file at the C:\Users\Roaming\qBittorrent pathname. The attacker must change the...

CVE-2022-33877

An incorrect default permission CWE-276 vulnerability in FortiClient Windows versions 7.0.0 through 7.0.6 and 6.4.0 through 6.4.8 and FortiConverter Windows versions 6.2.0 through 6.2.1, 7.0.0 and all versions of 6.0.0 may allow a local authenticated attacker to tamper with files in the...

CVE-2025-36747

The CVE entry for CVE-2025-36747 describes ShineLan-X firmware containing FTP server credentials, enabling testers to establish an insecure FTP connection. This can allow an attacker to replace legitimate firmware-deployed files with malicious versions because firmware signature verification is n...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

MAL-2025-189346 Malicious code in sanitize-eta-promise-error-awk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e00d20cc45b0c3561f876e2907c05759af75b6ae061f01d2d3240a3aefde578d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189631 Malicious code in spy-fire-kappa-emulate-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 387b32931e4b8b2b93f0b637405b93767f8bc7dd5b457a443eaf98e4d9600bcd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-187952 Malicious code in mdx-development-elara-stratosphere (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcc4bd235720b3f28d193fb963d4a38119a58061d2fb460cd83c464444e31b27 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gociy-ung-ugfis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47799aed05285af30b7b2b7dd395f8dfb7844d7670739d6f011f2f847862775d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183224 Malicious code in kisut-difg-diguafuavaotav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61f3896ad180725bfbad0ca39cadc686b7f9d995f5255f013a8491ee95727e04 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in oliobc-uyg-ugafiuh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9fe93ebed8298a4c907524d7ab6678b24bf41c2f2a36384a1f25c9677eb9d42 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mahiyafa-sutiyanu-gandofi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab41a4f8477bc0ea438adb59036de7c06774a4bd1a0b9e75a283275295e0ea6c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in poglymer-ogmih-afiaavg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 572781b23ecf8c3ef21aaa2a787e22e280a8c81b9e77817dd6a41bd5beea135d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kapino-samunvu-udvdabi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41cd263bd877b79059636cc5b21811273cbebcae82f27b20e34fd17f7aef26ca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mahiya-sutnu-goi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d81e63743729e8ba25b93ec0a3246f798db389aa281add8768cc4bf9c52ab10e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-177415 Malicious code in poglymer-ogmimh-avigpafdoaag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f10d96e582f391be94f91d743b7da3deb701ccbf8d43aac63c9c356f3cfddc0e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...