Malicious code in @asdfaskdjfksadhfkasf/nadaver2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffa99497d70b8eae199242d576c111b7b351efcf5d81d613e3f7b43eec257f27 The package declares a preinstall lifecycle script that executes index.js on npm install. index.js uses childprocess.exec to run a curl command whose...

EUVD-2026-83974

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parseentrypointdef in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...

CVE-2026-68919 GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages

GoCD is a continuous deliver server. From 13.3.0 until 26.1.0, GoCD does not correctly encode and escape malicious material modification comments that mimic the special trackback format used by package materials when rendering the Stage Detail, Job/Build Detail, Value Stream Map, and Pipeline...

CVE-2026-55071 MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can...

ROOT-APP-NPM-CVE-2024-46982 CVE-2024-46982 in next - Patched by Root

Root has patched CVE-2024-46982 in the next package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-71871 CVE-2026-71871 in orval - Patched by Root

Root has patched CVE-2026-71871 in the orval package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-62681 CVE-2026-62681 in orval - Patched by Root

Root has patched CVE-2026-62681 in the orval package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-71867 CVE-2026-71867 in orval - Patched by Root

Root has patched CVE-2026-71867 in the orval package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-62682 CVE-2026-62682 in orval - Patched by Root

Root has patched CVE-2026-62682 in the orval package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-71864 CVE-2026-71864 in orval - Patched by Root

Root has patched CVE-2026-71864 in the orval package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-71866 CVE-2026-71866 in orval - Patched by Root

Root has patched CVE-2026-71866 in the orval package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-72717 CVE-2026-72717 in orval - Patched by Root

Root has patched CVE-2026-72717 in the orval package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-71869 CVE-2026-71869 in orval - Patched by Root

Root has patched CVE-2026-71869 in the orval package for Root:npm. Multiple fixed versions available...

Important: Red Hat Security Advisory: yggdrasil-worker-package-manager security update

An update for yggdrasil-worker-package-manager is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

PT-2026-96107

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager improperly handles the TMPDIR environment variable when extracting package metafiles, even when operating as root or within setuid/setgid contexts. An attacker who can...

CVE-2026-88738

Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package upload functionality. An attacker with administrative privileges can upload a server-side executable file. The uploaded file is stored in a web-accessible executable location and can be...

PT-2026-96164

Name of the Vulnerable Software and Affected Versions Ajenti versions prior to 2.2.16 Description Authenticated users can access the '/api/core/tasks/start' endpoint to enqueue the InstallPlugin, UnInstallPlugin, or UpgradeAll functions from 'plugins/plugins/tasks.py' without requiring...

PT-2026-96318

Name of the Vulnerable Software and Affected Versions Moore Threads MTT S80 Driver Package version 340.150 Description Improper privilege management exists within the IOCTL Handler component of the mtdispkm64.sys library. Specifically, the sub 140006F0C function can be manipulated by a local...

PT-2026-96297

Name of the Vulnerable Software and Affected Versions Jazzware RT1000 Edge webUI version 20.0.1 Description The upgrade package upload functionality allows an authenticated attacker with administrative privileges to upload server-side executable files. These files are stored in a web-accessible...

PT-2026-96270

Name of the Vulnerable Software and Affected Versions Moore Threads MTT S80 Driver Package versions prior to 340.151 Description A heap-based buffer overflow exists in the IOCTL Handler component within the mtdispkm64.sys library. The issue occurs in the sub 140001000 function and requires local...