EUVD-2026-52913

MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious...

CVE-2026-47764

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...

Malicious code in @or-sdk/auth (npm)

npm/@or-sdk/auth is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by the...

MAL-2026-11879 Malicious code in @servicetitan/install (npm)

npm/@servicetitan/install is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

Malicious code in @servicetitan/install (npm)

npm/@servicetitan/install is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

MAL-2026-11558 Malicious code in @cacheable/memory (npm)

npm/@cacheable/memory version 2.2.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

Malicious code in cache-manager (npm)

npm/cache-manager version 7.2.10 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

Malicious code in launchdarkly-ai-server-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 460d36c416400537f8c90171c7821b191e0af69df3ec9f0c906300f50b0ea93f launchdarkly-ai-server-sdk 1.0.1 pypi was scanned across 7 files with no a static rule matches and no traced behavior of concern. No install-time or...

MAL-2026-11516 Malicious code in coldcard-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aea0829143169ee7227c8974c3b42125e95b89387a00ccb2b37d1d7344b041a The package presents itself as a helper for the Coldcard hardware wallet, but its actual behavior is credential and wallet theft. setup.py detects...

Malicious code in coldcard-helpers (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8aea0829143169ee7227c8974c3b42125e95b89387a00ccb2b37d1d7344b041a The package presents itself as a helper for the Coldcard hardware wallet, but its actual behavior is credential and wallet theft. setup.py detects...

CVE-2026-18612

A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.removepackage/plugins.installpackage of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The...

EUVD-2026-52395

A flaw has been found in GL-iNet GL-MT3000 up to 4.4.5. This vulnerability affects the function plugins.removepackage/plugins.installpackage of the file /cgi-bin/glc of the component plugins.so Native Plugin. This manipulation causes command injection. The attack can be initiated remotely. The...

EUVD-2026-52339

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall...

CVE-2026-18651

389 Directory Server is affected by a flaw where SASL PLAIN authentication installs connection-level bind credentials before checking if an account is locked, allowing continued privileged access on a connection after lock. The bound state is not reverted when a lock is detected, defeating accoun...

CVE-2026-4793

An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or write arbitrary files and conduct denial-of-service during installation...

ALSA-2026:49527 Important: frr security, bug fix, and enhancement update

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. Security Fixes: frr: FRRouting: Denial of Service via crafted BGP UPDATE message CVE-2026-37460 Bug Fixes and Enhancements: Zebra is not...

Malicious code in nvtorch-oot-nightly (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92503f2178663997d57ffa45fbb89f4a55de70e94f66745b4edf283a98e830f The package's setup.py issues an install-time HTTP request to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/nvtorchootnightly...

Malicious code in trtllm-subdir-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d2babc3deb7dd71a0515beeb63a43a5ab1b24bea455226652da9ea9377d1e5f setup.py performs an unconditional HTTP GET to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/trtllmsubdirtest at install time...

Malicious code in install-native-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 757eb666248556142f82ce2793cd42e7e30db4ce65efc823eaed2a71c14087f2 lib/report.js collects host and user identifying data via os.hostname, os.userInfo, execSync-invoked system commands, and fs.readFileSync of local...

MAL-2026-11468 Malicious code in install-native-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 757eb666248556142f82ce2793cd42e7e30db4ce65efc823eaed2a71c14087f2 lib/report.js collects host and user identifying data via os.hostname, os.userInfo, execSync-invoked system commands, and fs.readFileSync of local...