CVE-2026-66376

Credentials for a deleted user may remain valid for a short period under specific conditions...

MAL-2026-13915 Malicious code in kit-map-vim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03873a12af48745e3fd5173ce736267aebd3290be427275073562b8e1ada61fc On import of kit-map-vim, dist/index.mjs unconditionally spawns dist/internal/calc-math.dat as a detached child process after a SHA-256 self-check...

Malicious code in kit-map-vim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03873a12af48745e3fd5173ce736267aebd3290be427275073562b8e1ada61fc On import of kit-map-vim, dist/index.mjs unconditionally spawns dist/internal/calc-math.dat as a detached child process after a SHA-256 self-check...

Malicious code in dakumangalsingh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327 package.json declares a postinstall hook that executes a bundled Windows PE launcher DakuMangalSingh\DakuMangalSingh.exe at npm install time. The...

MAL-2026-13879 Malicious code in dakumangalsingh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 502c2aae77a471762612a5114d299651b7e75571d5c6d9dd5665a3dc2c503327 package.json declares a postinstall hook that executes a bundled Windows PE launcher DakuMangalSingh\DakuMangalSingh.exe at npm install time. The...

Malicious code in @years18/n8n-nodes-utils-helper-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3cd688f6f3a7075db2ae860db719600fda1fdd23485262a9f72de758834a582 The package presents itself as an n8n community node but ships a hostile payload in both callback.js invoked from scripts.postinstall and index.js...

Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access

Threat actors have begun to actively exploit a recently patched critical security flaw in Broadcom VMware vCenter, according to new findings from QUIRSO. The vulnerability in question is CVE-2026-59310 CVSS score: 9.8, a directory-traversal vulnerability in the VMware vCenter server that a...

PT-2026-71100

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Credentials for a deleted user may remain valid for a short period under specific conditions. Recommendations At the moment, there is no information about a new...

DEBIAN-CVE-2026-73249

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/libraryid/bookid/fmt in src/calibre/srv/books.py omits needsdbwrite=True, causing Router.dispatch to skip ctx.checkforwriteaccess before updateannotations passes attacker-controlled JS...

Malicious code in safe-local-env-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79536d7a1e4238fcad87abef5becbb3233148c071cae3c095798417a012896f8 safe-local-env-loader impersonates the legitimate dotenv package: its description, repository, homepage, and lib/main.js are copied from...

MAL-2026-13741 Malicious code in safe-local-env-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79536d7a1e4238fcad87abef5becbb3233148c071cae3c095798417a012896f8 safe-local-env-loader impersonates the legitimate dotenv package: its description, repository, homepage, and lib/main.js are copied from...

Malicious code in kit-vim-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1b76be1956e2772f73d7712934ee4a296d4407df590f6ca4225db7310de916 The package advertises itself as a dependency-free calendar/streak math library but ships a Linux x8664 ELF at dist/internal/calc-math.dat. The main...

MAL-2026-13740 Malicious code in kit-vim-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1b76be1956e2772f73d7712934ee4a296d4407df590f6ca4225db7310de916 The package advertises itself as a dependency-free calendar/streak math library but ships a Linux x8664 ELF at dist/internal/calc-math.dat. The main...

CVE-2026-72747 AVideo Stored Cross-Site Scripting via Unauthenticated Registration

AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected...

CVE-2026-73234: Improper Limitation of a Pathname to a Restricted Directory

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore in src/App/PropertyFile.cpp concatenates an attacker-controlled file or data attribute from Document.xml with the document transient path without rejecting directory components,...

MAL-2026-13694 Malicious code in env-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7faefbcd9110b5e08b469d72d6541875ba4e2702c4490d1a24c37b313160f86b env-local presents itself as a dotenv-compatible.env loader README, keywords, and API mirror motdotla/dotenv, but lib/main.js unconditionally require...

Malicious code in chaintest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9567c10f25971b44c76d2a2609ce347c2d03d4d600520cd4bfc75a5001552c3c chaintest 0.1.0 on PyPI could not be fully characterized from the available artifacts. No concrete a static rule matches and no traced code evidence...

MAL-2026-13686 Malicious code in chaintest (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9567c10f25971b44c76d2a2609ce347c2d03d4d600520cd4bfc75a5001552c3c chaintest 0.1.0 on PyPI could not be fully characterized from the available artifacts. No concrete a static rule matches and no traced code evidence...

MAL-2026-13674 Malicious code in statist-browser-typed-client-eventea.projects.tdeal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56afa18eac7769497f21431af2a739dd5040563541223e41786746e0c44957a2 Package contains 2 files with no static or behavioral indicators of supply-chain attack shapes. No lifecycle scripts fetching remote content, no...

MAL-2026-13673 Malicious code in statist-browser-typed-client-eventea.projects.pwakasko (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86f33793b44bee99cf40ae7b4ecfdd4d8ab388edf96753862f96b289ad3e95d2 Package contains only 2 files and no code patterns indicating credential access, network exfiltration, install-time code execution, silent relay, or...