EUVD-2026-53354

Node-RED's local-filesystem library storage module getLibraryEntry and saveLibraryEntry in packages/nodemodules/@node-red/runtime/lib/storage/localfilesystem/library.js, reachable via GET/POST /library/:lib/:type/path, joins the user-supplied path parameter directly into the filesystem path via...

EUVD-2026-53353

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses FILE:path content directives from uploaded Structured Text .st program files and writes the referenced content to os.path.join'./core', filepath with no validation that filepath stays within the ./core directory. A crafted ....

CVE-2026-71268 OpenPLC Runtime v3 Path Traversal in Structured Text FILE Directive Leading to Arbitrary File Write

OpenPLC Runtime v3's compileprogram function webserver/openplc.py parses FILE:path content directives from uploaded Structured Text .st program files and writes the referenced content to os.path.join'./core', filepath with no validation that filepath stays within the ./core directory. A crafted ....

EUVD-2026-53347

IoTSharp BlobStorageController.cs lacks the Authorize attribute applied to every other controller in the application DevicesController, CustomersController, TenantsController, etc., and no global authorization FallbackPolicy is configured in Startup.cs, leaving its...

CVE-2026-71259 ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py: if parsed.scheme and parsed.netloc or parsed.scheme == "file": return parsed.geturl. Because and binds tighter than or, any file: URI passes validation regardless of netloc. Th...

Malicious code in saas-f-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b4a492a289f0cc0ec0f924149b0cd29521c60747d6fe700d84d03ddddcd8a65 On require, index.js loads setup.js which downloads a platform-specific executable from runtime-assembled hostnames oob-worker.cf103-07.0.workers.dev...

Malicious code in warp-drive-internal-tooling (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a62165101225b7ad5371e9310e013a9e1dc69b59a475a7a4ccd7cdf0d7996c1d [email protected] declares a preinstall hook that runs index.js, which on Windows spawns a hidden-window PowerShell process powershe...

Malicious code in aegis-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a66d1f02c3c943836d41a7ec92c150c5529880890a4cc502115412dddb0c519c The package's declared postinstall hook runs node src/test.js, which issues an HTTPS GET to https://workconfig.vercel.app with TLS certificate...

Malicious code in @rentwise/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e2ac6bf5ebc05e3dcf6a84122d0b10d5d5f36c5b4cec9f8d0b305d1b8125f47 build/index.js appends an evalatob... blob to the legitimate common-library exports, so the payload runs whenever any consumer requires...

MAL-2026-12493 Malicious code in utility-kit-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11d4f4654f1acbc26d30e2ea0cae4816bf6e3a847dce2456134d050a38a8a575 The package's default export getPlugin issues a fetch to the hardcoded bare-IP URL https://31.97.137.157:45000/icons/109 and passes the returned...

Malicious code in utility-kit-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11d4f4654f1acbc26d30e2ea0cae4816bf6e3a847dce2456134d050a38a8a575 The package's default export getPlugin issues a fetch to the hardcoded bare-IP URL https://31.97.137.157:45000/icons/109 and passes the returned...

Malicious code in dolyame-boxy-atom-bnpl-store-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b82cb3b1e0ca7de56472ae3d263144d8131faf53d64761943decb8937fd5bc6a On require, index.js loads loader.js, which downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at runtime...

Malicious code in pfp-block-mobile-steps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4b4495333f6f37664594f2e6533842a4d3a317bb98bbc3a467797bb8ec851d7 On require of the package, index.js unconditionally loads shim.js, which selects a payload path based on process.platform/arch linuxx64, linuxarm64,...

Malicious code in express-mongo-santi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33 The package's main file index.js is a heavily obfuscated bundle obfuscator.io-style rotated string array with base64+RC4 decoders whose only purpose ...

CVE-2026-46581

In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target...

CVE-2026-18933

The wp-downloadmanager WordPress plugin, in version 1.68.11 also affecting the 6.9.4 release line, allows an admin-privileged user currentusercan'managedownloads' to upload arbitrary files via download-add.php with no extension or MIME-type validation of any kind - no wpcheckfiletypeandext, no...

Malicious code in tt-help-cli-ycl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6144be61d70f258741e5d4cc1476021f93e3ce82ffa00a3f86189537a1438a6 The package's tt-help watchdog subcommand starts a long-running agent that POSTs heartbeats to a remote server default hardcoded to...

MAL-2026-12488 Malicious code in tt-help-cli-ycl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6144be61d70f258741e5d4cc1476021f93e3ce82ffa00a3f86189537a1438a6 The package's tt-help watchdog subcommand starts a long-running agent that POSTs heartbeats to a remote server default hardcoded to...

EUVD-2026-53336

A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs over 64 KiB in stateful modes such as Counter CTR or Cipher Block Chaining CBC, the library improperly reuses the Initialization Vector IV for each internal data chunk. A remote attacker could...

Malicious code in statist-browser-typed-client-sme.platform.web.teasers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30e7b10d7a21e347dca99c9bf32f2c4d81aef8bdc78a10d308b63a881db69027 The package's declared main index.js unconditionally requires./init on load. init.js selects a platform-specific asset win32/darwin/linuxx64/linuxarm...