92581 matches found
Exploit for CVE-2026-105482
CVE-2026-105482 – Node.js dns.resolve NUL byte truncation...
MSC-2026-13024
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...
HTTP CONNECT Tunnel Authority Validation Bypass
io.netty:netty-codec-http3 is vulnerable to HTTP CONNECT tunnel authority validation bypass. The vulnerability is due to incorrect parsing and conversion of HTTP/1 CONNECT requests in HttpConversionUtil.toHttp3Headers, which allows a remote attacker to manipulate the Host header to specify an...
Malicious code in moveworks-capi-starter (PyPI)
Source: kam193 2cd8f99409a87f01743f65f381fefa800176a29d47d6119743ae2bd0ce1f7583 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...
Security Bulletin: SOAR App Host is vulnerable to using components with known vulnerabilities (CVE-2026-16440)
Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. SOAR APP host has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-16440 DESCRIPTION: In Eclipse OpenJ9 versions up to 0.60, a...
Security Bulletin: SOAR App Host is vulnerable to using components with known vulnerabilities (CVE-2026-61308, CVE-2026-70907, CVE-2026-60589)
Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. SOAR APP host has addressed the applicable CVEs with an update. Vulnerability Details CVEID:CVE-2026-61308 DESCRIPTION: Difficult to exploit vulnerability allows...
MSC-2026-13017
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-13006
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...
MSC-2026-13013
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
MSC-2026-13005
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...
php-cve-defensive-audit-kit
PHP Defensive Host Audit Kit Safe host-side configuration v...
Malicious code in moveworks-capi-starter (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82a1f2ebbd0f8423c7e02c1a9b0571cec02bd6d343b88583f6a85dd06a056a99 setup.py overrides the install command to collect the installer's hostname and resolved local IP address and POST them as JSON to the hardcoded URL...
MAL-2026-18122 Malicious code in moveworks-capi-starter (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82a1f2ebbd0f8423c7e02c1a9b0571cec02bd6d343b88583f6a85dd06a056a99 setup.py overrides the install command to collect the installer's hostname and resolved local IP address and POST them as JSON to the hardcoded URL...
BIT-SEAWEEDFS-2026-100413 SeaweedFS: Hard-coded SSH host key can be presented by certain standalone SFTP Helm deployments
SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfssftpsshprivatekey. A standalone deployment presented that...
CLSA-2026-1792478956 emacs: Fix of 2 CVEs
CVE-2026-108976: fix Tramp user and host name validation - CVE-2026-79992: strengthen Tramp user and host name limitations...
CLSA-2026-1792478726 emacs: Fix of 2 CVEs
CVE-2026-108976: fix Tramp user and host name validation - CVE-2026-79992: strengthen Tramp user and host name limitations...
CVE-2026-105044
Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform Host Monitoring V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection...
CVE-2026-105044 OS Command Injection in Qingteng Host Adaptive Security Platform Security Toolbox
Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform Host Monitoring V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection...
EUVD-2026-106928
Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform Host Monitoring V3.0 allows an authenticated console administrator to execute arbitrary commands on attached clients via OS command injection...
CVE-2026-105044
The Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 is vulnerable to OS command injection in the Security Toolbox component. The root cause is the improper neutralization of special elements used in an OS command. This flaw affects versions prior to 20260929 and allows an authenti...