EUVD-2026-56374

Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally...

Malicious code in bs58-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d59b2d561269e6779eed82e12abe726403e9a2419936c01a4deaea9c3e70b2c Package bs58-12 presents itself as the popular bs58 base58 library README copied from bs58, advertising npm i --save bs58 but its own code is a thin...

MAL-2026-13740 Malicious code in kit-vim-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1b76be1956e2772f73d7712934ee4a296d4407df590f6ca4225db7310de916 The package advertises itself as a dependency-free calendar/streak math library but ships a Linux x8664 ELF at dist/internal/calc-math.dat. The main...

Malicious code in kit-vim-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1b76be1956e2772f73d7712934ee4a296d4407df590f6ca4225db7310de916 The package advertises itself as a dependency-free calendar/streak math library but ships a Linux x8664 ELF at dist/internal/calc-math.dat. The main...

Remote Access API Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locally...

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally...

Remote Access API Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locally...

MAL-2026-13763 Malicious code in fetch-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5c49646ea7e22e74073aa7d8c9596d7d93100c429033383e975a2ab080de28 Package name is 'fetch-runtime' but the source is a copy of npm's 'make-fetch-happen' repository, README, and author metadata all reference...

Malicious code in lines-columns (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c9abe51d09dfaa6a2e38e60df64038009c1029b34587cc2c8906d37642187cd Package name 'lines-columns' closely resembles the popular 'lines-and-columns' package, and the README instructs users to install 'lines-and-columns'...

EUVD-2026-55925

Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data...

PT-2026-70659

Name of the Vulnerable Software and Affected Versions Windows Remote Access API affected versions not specified Description A heap-based buffer overflow in the Windows Remote Access API allows an authorized attacker to elevate privileges locally. A heap-based buffer overflow occurs when a program...

PT-2026-70729

Name of the Vulnerable Software and Affected Versions Microsoft Office Excel affected versions not specified Description A type confusion issue occurs when a resource is accessed using an incompatible type. This allows an unauthorized attacker to execute arbitrary code locally or remotely,...

The vulnerabilities of the functions EllipticCurvePublicNumbers.public_key(), EllipticCurvePublicNumbers.public_key(), load_der_public_key(), and load_pem_public_key() in the Python-cryptography cryptographic library allow a perpetrator to gain access to confidential data.

The vulnerabilities of the functions EllipticCurvePublicNumbers.publickey, EllipticCurvePublicNumbers.publickey, loadderpublickey, and loadpempublickey in the Python-cryptography cryptographic library are related to insufficient validation of data authenticity. Exploiting these vulnerabilities...

PT-2026-70535

Name of the Vulnerable Software and Affected Versions Windows Remote Access Connection Manager affected versions not specified Description A heap-based buffer overflow occurs in the Windows Remote Access Connection Manager. This issue allows an authorized attacker to elevate privileges locally on...

PT-2026-70934

The distributed Mira Android APK v4.5.15.4 allows an attacker read/write access to reproductive health profiles from internet connected hosts, which could result in forgery, deletion, or destruction of health information...

PT-2026-70658

Name of the Vulnerable Software and Affected Versions Windows Remote Access API affected versions not specified Description A heap-based buffer overflow in the Windows Remote Access API allows an authorized attacker to elevate privileges locally. A heap-based buffer overflow occurs when a program...

PT-2026-70366

Name of the Vulnerable Software and Affected Versions Cisco Secure Firewall Adaptive Security Appliance ASA affected versions not specified Cisco Secure Firewall Threat Defense FTD affected versions not specified Description Insufficient error checking when processing HTTP requests in the Remote...

Malicious code in @sqlite-labs/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77614b62a827121762f2140a37b26e96408f18c0ccd122069c2ae311918541ef @sqlite-labs/[email protected] ships an index.js that is a copy of the feross/buffer library with a single injected top-of-file statement var ins =...

MAL-2026-13713 Malicious code in @sqlite-labs/createsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 375677417b15f83a0823aaf14899d5d55c2ae1f69820980fb68d618919ae1a75 The package's main entry index.js fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket...

CVE-2025-13293

A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticat...