MAL-2026-10573 Malicious code in harpoon-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc473ffcde7c9ffe6850429607ee9dd33a5cbd4cf30ad071f111693cef79045e The exported registerGracefulShutdown API — advertised in the README as a small server-helper for graceful shutdown, health, and tick profiling —...

MAL-2026-10552 Malicious code in eth-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f051957ac6f91e8567df873978b45c0c81a170f94decbd735d329f312ff1bb On require, index.js schedules a 37-second delayed routine that reads test/fixtures/keypairs.dat, base64-decodes it into /.cache-db/.node-sync/syncd....

Malicious code in cbr-internal-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa96f42fade399b9e73756e2abd62eafbfa11e2eb02fe1055d9c7e025fba4ab7 On module load, the package's main entrypoint shells out via childprocess.exec to run cat /etc/passwd and prints the contents to stdout. This fires...

Malicious code in @vitets/vite-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fe093d0d0fa83ab20aa57e9d9c8500e03a25ead578ff351fdc3609118cf5ecf Package is published as @vitets/vite-ts and copies the legitimate Vite project's author Evan You, README, homepage vitejs.dev, and repository...

Malicious code in @vite-ts/vite-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6076869d73ce328ffd736c9df9d269cd99e505ffc3bfceae5d3f5a633a8c420 Package @vite-ts/[email protected] impersonates the legitimate vite package: it clones vite's README, declares author 'Evan You', homepage...

MAL-2026-10526 Malicious code in @vite-pro/vite-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9aaf307faea8efb93af6f3c8ee4811304a7d9afa25f1c9525aed108efea439e7 Package @vite-pro/vite-ui impersonates the official vite package: package.json declares author Evan You, points repository at github.com/vitejs/vite,...

Malicious code in chai-as-sets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e62935357bb620be6ade887e298b5e5bbd6bff0b7a171a79f852d19c58142da4 The package name and description advertise a chai plugin, but the main entry point spawns a detached child process lib/initializeCaller.js when the...

MAL-2026-10519 Malicious code in chai-as-sets (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e62935357bb620be6ade887e298b5e5bbd6bff0b7a171a79f852d19c58142da4 The package name and description advertise a chai plugin, but the main entry point spawns a detached child process lib/initializeCaller.js when the...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the feishu process. An attacker can perform unauthorized operations by exploiting insufficient authorization checks on certain actions, allowing lower-trust...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization through the restart and duplicate processes. An attacker can continue to create new timesheet entries for projects they no longer have access to by leveraging historical timesheet records after their permissions ha...

PT-2026-58973

Summary A path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip files containing archive members with maliciously crafted names e.g., ../../../../etc/password can be written to arbitrary locations on the filesystem when an administrator restores the archive a...

PT-2026-60094

Summary Two-factor authentication TOTP can be fully bypassed for the REST API. The KIMAI SESSION cookie returned in the response to the login request; issued after only the password is verified, before the TOTP step; is already accepted as authenticated by every /api/ endpoint. So after submittin...

CVE-2025-40945: Untrusted Search Path

A vulnerability has been identified in COMOS V10.4.5 All versions V10.4.5.0.2, COMOS V10.6 All versions V10.6.1, Designcenter NX All versions V2512.7000, Simcenter 3D All versions V2512.7000, Simcenter Femap V2506 All versions V2506.0003, Simcenter Femap V2512 All versions V2512.0002, Simcenter...

SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2026:2852-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2852-1 advisory. This update for MozillaThunderbird fixes the following issues Update to Firefox 140.12.0 ESR MFSA 2026-58,...

PT-2026-57998

Name of the Vulnerable Software and Affected Versions COMOS V10.4.5 versions prior to V10.4.5.0.2 COMOS V10.6 versions prior to V10.6.1 Designcenter NX versions prior to V2512.7000 Simcenter 3D versions prior to V2512.7000 Simcenter Femap V2506 versions prior to V2506.0003 Simcenter Femap V2512...

PT-2026-58741

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.125 Description Insufficient validation of untrusted input in Navigation allows a remote attacker who has compromised the renderer process to bypass navigation restrictions using a crafted HTML page...

CVE-2026-15774: Use After Free

Use after free in Skia in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-51807

Heap-based out-of-bounds write in j2kprecinctsubband::parsepacketheader in OpenHTJ2K versions 0.18.3 and earlier fixed in v0.18.4 caused by missing bounds validation before coding-pass lengths are written to j2kcodeblock::passlength128. A crafted JPEG 2000 codestream containing malformed PPM pack...

PHP-FPM XSS

The vulnerability of the PHP-FPM process manager, a PHP programming language interpreter, exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code XSS using a specially created URL address...

GPAC multimedia Platform DoS

The vulnerability of the txtinprocesstexml function on the GPAC multimedia platform is related to the execution of operations outside the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to cause a service failure...