232697 matches found
MAL-2026-10879 Malicious code in @dxcl/user-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10875 Malicious code in @dxcl/http-common-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10872 Malicious code in @dxcl/account-js (npm)
--- -= Per source details. Do not edit below this line.=-...
Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect IBM Installation Manager and IBM Packaging Utility
Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 11 used by IBM Installation Manager and IBM Packaging Utility. Vulnerability Details CVEID:CVE-2025-53057 DESCRIPTION: An unspecified vulnerability in Java SE related to the Security component could allow a remot...
WordPress Real Estate Manager Pro plugin <= 12.8.5 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Real Estate Manager Pro versions = 12.8.5...
MAL-2026-10850 Malicious code in @gocortexio/npmgremlinbox-tapr-ohl-1-0 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0fbd65fb65b76a2422d3780b7c2c82554753c78740a272f5c064d40fa239437 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-10853 Malicious code in @gocortexio/npmgremlinbox-typosquat-chalk (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9195f06446d35d2bfefdd565bd2c6f88680cd808d77ff00b4ff0b295cc84110 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-10839 Malicious code in @gocortexio/npmgremlinbox-mpl-2-0 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fee530f600c3dda2f184f9f4cbeb4dbe23b98fa5c6e426e89afceffadce4175d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-10848 Malicious code in @gocortexio/npmgremlinbox-simpl-2-0 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19cca0040a0e06465540014785a7885bdcb84de6915594fc7b1802db431e67ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-10843 Malicious code in @gocortexio/npmgremlinbox-osl-3-0 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d30579e205476f67d9146972cc0e2aabdd79345dabe3af1c9e0d07fd8d81a9f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-10838 Malicious code in @gocortexio/npmgremlinbox-mpl-1-1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16b711dafb2bb4c7dfab16c8144346191d7e09f630cfa91e7dd9e3b9b9960151 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-10840 Malicious code in @gocortexio/npmgremlinbox-ms-lpl (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c00cf6119e52189754e58f2c2460b83968a20c5086aa9424d58123b077c9e7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-10845 Malicious code in @gocortexio/npmgremlinbox-polyform-small-business-1-0-0 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0866e7aff8ea636693be1eeddf556d478e3445fee6eb018cda424075a73f1434 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager - Remote Code Execution
Cisco Prime Infrastructure PI and Cisco Evolved Programmable Network EPN Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An...
Linux Distros Unpatched Vulnerability : CVE-2026-64106
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID...
Linux Distros Unpatched Vulnerability : CVE-2026-63884
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/i915: Fix potential UAF in TTM object purge TLDR: The bo-ttm object might be changed by calling ttmbovalidate, move casting it to an i915tt object later to...
MAL-2026-10934 Malicious code in twilio-internal (npm)
The twilio-internal package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against ...
Oracle Linux 10 : yggdrasil-worker-package-manager (ELSA-2026-19128)
The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-19128 advisory. 0.2.3-7 - Bump release for rebuild 0.2.3-6 - Bump release for rebuild Tenable has extracted the preceding description block directly from the Oracle Linux...
Malicious code in supplyhub (npm)
The npm package supplyhub is a credential / SSH-key stealer. Its package.json declares a postinstall lifecycle hook postinstall: node postinstall.js that executes automatically on npm install, before the package is ever imported. postinstall.js uses fs.readFileSync to read the user's SSH private...
