MAL-2026-1392 Malicious code in @dinzid04/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52c73bb6dd5e6b3ba149f8a95cc91deaa505ee81bbdc34eca6e16bd7d2cc1a2f The package @dinzid04/libsignal-node was found to contain malicious code. Source: ghsa-malware...

Malicious code in @dinzid04/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52c73bb6dd5e6b3ba149f8a95cc91deaa505ee81bbdc34eca6e16bd7d2cc1a2f The package @dinzid04/libsignal-node was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1390 Malicious code in @depro-tech/cortana-md (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ab02cdce682fe76e6709fc00a3df615b366f38ed30270f635ddca7b122275fc The package @depro-tech/cortana-md was found to contain malicious code. Source: ghsa-malware...

Malicious code in tradepmr-api-utils-drzak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed879324b5de23922f365eaef686660dd2a42745f101998d954eda9c03449b1b The package tradepmr-api-utils-drzak was found to contain malicious code. Source: ghsa-malware...

Malicious code in dell-internal-auth-drzak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbfacc6ee81634bba390c5b27b3d5257f8b0d2148e93978085136c337d158ab6 The package dell-internal-auth-drzak was found to contain malicious code. Source: ghsa-malware...

Malicious code in dell-fusion-core-drzak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d5d156081b9f33279287f433edff50b49a63fa67e0da031c374075fde1cc24f The package dell-fusion-core-drzak was found to contain malicious code. Source: ghsa-malware...

CVE-2026-22199 Voltronic Power SNMP Web Pro 1.1 Path Traversal via upload.cgi

Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload.cgi endpoint that allows unauthenticated attackers to read arbitrary files on the device filesystem by supplying directory traversal sequences in the params parameter. Attackers can...

CVE-2026-22199

Technical details for CVE-2026-22199 are not publicly available in the provided connected documents. Monitor for updates from the vendor and CVE feeds.

CVE-2026-22199

Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload.cgi endpoint that allows unauthenticated attackers to read arbitrary files on the device filesystem by supplying directory traversal sequences in the params parameter. Attackers can...

CVE-2026-22199 Voltronic Power SNMP Web Pro 1.1 Path Traversal via upload.cgi

Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload.cgi endpoint that allows unauthenticated attackers to read arbitrary files on the device filesystem by supplying directory traversal sequences in the params parameter. Attackers can...

PT-2026-25140

Name of the Vulnerable Software and Affected Versions wpDiscuz versions prior to 7.6.47 Description The software contains a flaw that allows manipulation of comment votes. Attackers can obtain fresh nonces and bypass rate limiting by using client-controlled headers. Specifically, attackers can...

PT-2026-28450

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.11 Description OpenClaw contains a privilege escalation issue within the device.token.rotate function. Callers possessing operator.pairing scope can generate tokens with expanded scopes, bypassing intended sco...

MAL-2026-1372 Malicious code in @sky-it-livedata-libraries/livedata-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20bdbc3cff45e6eac27e84e332d4efa6ad06a4d593b15610a99115bac25d2931 The package @sky-it-livedata-libraries/livedata-commons was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1370 Malicious code in mezukabil (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 116aeb117747dfbea2f28ecfaae0e59f69c1c476942bc00335519de4e68a8c84 The package mezukabil was found to contain malicious code. Source: ghsa-malware 554fc63eb509f787fc60a615d7228f13eb692391a1a1dca733d3031716dd2ff8 Any...

Malicious code in praxis-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f147ac7e867b493ef159ddfdd294c57a1bfbbd8e502037178470c37345ca0628 The package praxis-scripts was found to contain malicious code. Source: ghsa-malware 9cf02a0374cd88b4ae46f34a484f0441ea2bfaf3c6799812ea6b4cf4e916cd0c...

Malicious code in libsignal-mod (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 211e000c840d09f14adc470cd83c124e8a4e49249e78c8a759693e3678c63da2 The package libsignal-mod was found to contain malicious code. Source: ghsa-malware bb9ca486dd8fcc83473d13eb8fd8c5f8881d2be2d8301a167de2d40ad8513c51...

Malicious code in react-svg-anchor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e014ccf1aaf52a0f5ad92a977b2fb987b63be3ae7bdf8fa9b5f8813f68040344 The package react-svg-anchor was found to contain malicious code. Source: ghsa-malware d539493dcc209d4d478ffa4a5893cd5cd01ee1d994700b9492b651c8aeb372...

Malicious code in restrict-imports (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f82360676317e6d9c2b69a82034af73f2008890871348fb45bc5b966f6aca03c The package restrict-imports was found to contain malicious code. Source: ghsa-malware e153e68a84a468be42de7a7c49af2d4e73778f4462d854be60a6e8baf03105...

MAL-2026-1344 Malicious code in bignum-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7424fa86053a143f5eae6585268b643e7b473544dfb04279e159857d32ee3565 The package bignum-ts was found to contain malicious code. Source: ghsa-malware 91982cc34a885d97932c4e298eae656831e28ca39aa3b19ac261f368647056d3 Any...

Malicious code in mui-path-imports (npm)

The package 'mui-path-imports' is part of the PhantomRaven supply chain attack campaign Wave 4. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...