Malware in @revizahoshii/hoshino-store-postgres

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-17830 Malicious code in @revizahoshii/hoshino-store-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 413598986f6891c8b092769e99f8995809b19b477eb3dff36899d857aec516ab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

msploitego

msploitego - El conjunto de pentesting para Maltego ESTA ES UNA VERSIÓN BETA, por favor sea amable y reporte cualquier problema Novedades Nuevas características Ahora compatible con múltiples workspaces para Metasploit a través de consultas Postgres Un script bash que ejecuta toneladas de módulos...

@adenta/cms (>=0.0.6, <=1.1.1-0), @lafllamme/personal-page-shared (>=1.0.0, <=1.2.0) +1 more potentially affected by CVE-2026-105856 via @payloadcms/db-postgres (>=3.46.0, <=3.61.0)

@payloadcms/db-postgres NPM version =3.46.0, =0.0.6, =1.0.0, =1.2.0 - @otherdev-software/canvas 1.0.0 Source cves: CVE-2026-105856 Source advisory: GHSA-PJ7X-6WPF-PGVP...

Payload: SQL injection in SQLite/Postgres

Impact An attacker who has read plus create or update access to a collection can submit a request that includes a SQL injection targeting a specific field path shape and operators in Payload's SQLite and Postgres. You are affected if: - You use @payloadcms/db-sqlite or @payloadcms/db-d1-sqlite. -...

@adenta/cms (>=0.0.6, <=1.1.1-0), @lafllamme/personal-page-shared (>=1.0.0, <=1.2.0) +1 more potentially affected by CVE-2026-105856 +1 more via @payloadcms/db-postgres (>=3.46.0, <=3.61.0)

@payloadcms/db-postgres NPM version =3.46.0, =0.0.6, =1.0.0, =1.2.0 - @otherdev-software/canvas 1.0.0 Source cves: CVE-2026-105856, CVE-2026-63316 Source advisory: OSV:GHSA-PJ7X-6WPF-PGVP...

GHSA-PJ7X-6WPF-PGVP Payload: SQL injection in SQLite/Postgres

Impact An attacker who has read plus create or update access to a collection can submit a request that includes a SQL injection targeting a specific field path shape and operators in Payload's SQLite and Postgres. You are affected if: - You use @payloadcms/db-sqlite or @payloadcms/db-d1-sqlite. -...

Linux Distros Unpatched Vulnerability : CVE-2026-83550

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in postgres-exporter. Due to the blank import of net/http/pprof, debug endpoints are exposed on the unauthenticated metrics listener. A remote...

DEBIAN-CVE-2026-83550

A flaw was found in postgres-exporter. Due to the blank import of net/http/pprof, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process...

CVE-2026-83550

A flaw was found in postgres-exporter. Due to the blank import of net/http/pprof, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process...

UBUNTU-CVE-2026-83550

A flaw was found in postgres-exporter. Due to the blank import of net/http/pprof, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process...

CVE-2026-83550

A flaw was found in postgres-exporter. Due to the blank import of net/http/pprof, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process...

CVE-2026-83550 Postgres-exporter: net/http/pprof exposed on metrics listener

A flaw was found in postgres-exporter. Due to the blank import of net/http/pprof, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process...

CVE-2026-83550

A flaw in postgres-exporter exposes debug endpoints on the unauthenticated metrics listener due to a blank import of net/http/pprof . A remote attacker within the cluster network can access these endpoints to perform information disclosure , potentially uncovering process arguments, goroutine sta...

EUVD-2026-93776

A flaw was found in postgres-exporter. Due to the blank import of net/http/pprof, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process...

CVE-2026-83550

A flaw was found in postgres-exporter. Due to the blank import of "net/http/pprof", debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process...

CVE-2026-83550 Postgres-exporter: net/http/pprof exposed on metrics listener

A flaw was found in postgres-exporter. Due to the blank import of net/http/pprof, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process...

CVE-2026-83550

A flaw was found in postgres-exporter. Due to the blank import of net/http/pprof, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process...

CVE-2026-83550

A flaw was found in postgres-exporter. Due to the blank import of net/http/pprof, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process...

CVE-2026-105856

Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with blocksAsJSON enabled can inject SQL through a crafted field path and operator...