28096 matches found
MAL-2026-10744 Malicious code in patchwork-os (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc351c90dbe7a3ede9536138db9071a7cc8b2f8b2824b7956f26553e349a72d9 dist/drivers/gemini/index.js line 53 contains a literal curl https://attacker string co-located with an install reference line 286, matching a...
Malicious code in dde-common (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f875cacd68379cbaaa066adac089dc3c403fd532a0e73ba932cf35e0562ff476 setup.py installs a telemetry.pth file into site-packages containing import telemetryinit, which causes Python's site.py to load the bootstrap module...
CVE-2026-63304
AVideo
CVE-2026-63304 AVideo through 29.0 OS Command Injection via listFFmpegProcesses
AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can brea...
CVE-2026-63304 AVideo through 29.0 OS Command Injection via listFFmpegProcesses
AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can brea...
Sensor Data Service Windows Privilege Escalation
The vulnerability of the Sensor Data Service system service in Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to gain elevated privileges...
Microsoft Message Queuing Privilege Escalation
The vulnerability of the Microsoft Message Queuing MSMQ queue service on Windows operating systems is related to integer overflows. Exploiting this vulnerability can allow an attacker to increase their privileges...
Win32k.sys Privilege Escalation
The vulnerability of the Win32k.sys component of the Windows operating system is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow an attacker to gain increased privileges...
Windows HTTP/2 DoS
The vulnerability of the HTTP/2 network protocol implementation in Windows operating systems is related to the unlimited distribution of resources. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
Windows TCP/IP Privilege Escalation
The vulnerability of the TCP/IP protocol implementation in Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...
Vim Command Injection
The vulnerability of the Vim text editor is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
USB Print Driver Privilege Escalation
The vulnerability of the USB Print Driver driver for Windows operating systems is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to increase their privileges...
Active Directory Certificate Services Privilege Escalation
The vulnerability of Active Directory Certificate Services on Windows operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to increase their privileges remotely...
Adobe Animate Code Execution
The vulnerability of the Adobe Animate software for creating multimedia and computer animations is related to the lack of measures taken to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability allows an attacker to execute arbitrary code...
PT-2026-60674
Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell exec. After the fix for GHSA-9643-6xjp-vx57 which added $ to the blocklist, the characters | single pipe, backtick, and the newline byte 0x0A remain...
PT-2026-60697
Name of the Vulnerable Software and Affected Versions Pheditor versions 2.0.1 through 2.0.5 Description The terminal feature in Pheditor contains a flaw in how it sanitizes user-supplied commands before passing them to the shell exec function. While a blocklist is used to filter dangerous...
NPM: systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux
NPM: systeminformation: OS command injection in networkInterfaces via interfaces5 source-directive path on Linux vulnerability discovered by ? in WordPress Npm systeminformation versions = 5.31.6...
CVE-2026-15895
OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or...
