Malicious code in dotenv-precheck (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 446a8483dbc9e696506f44c6777b7c086b1b919b2585b5e5c99ca5f6e2e19a8e [email protected] is a credential-stealing package disguised as a dotenv preflight utility. package.json wires index.js as a postinstall script, ...

CVE-2026-82804

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

EUVD-2026-88812

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

CVE-2026-82804

The Apache DolphinScheduler (versions before 3.4.3 ) is vulnerable to command injection in the Alert Script plugin . The root cause is the incorporation of the scriptPath parameter into a /bin/sh -c command without sufficient neutralization of shell metacharacters. An authenticated user can explo...

CVE-2026-82804 Apache DolphinScheduler: Command Injection in the Alert Script Plugin

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

CVE-2026-82804 Apache DolphinScheduler: Command Injection in the Alert Script Plugin

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

Malicious code in exprrdd (npm)

The package exprrdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17244 Malicious code in exprrdd (npm)

The package exprrdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17246 Malicious code in exptred (npm)

The package exptred impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

CVE-2026-102875: Improper Limitation of a Pathname to a Restricted Directory

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

CVE-2026-102878: Origin Validation Error

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

PT-2026-102891

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

PT-2026-102894

Name of the Vulnerable Software and Affected Versions mcp-chrome-bridge versions prior to 1.0.32 Description An origin validation error exists in the native-server HTTP API that allows attackers to bypass Cross-Origin Resource Sharing CORS restrictions. CORS is a security mechanism that restricts...

PT-2026-102816

Name of the Vulnerable Software and Affected Versions JupyterLab versions 4.5.0 through 4.5.10 JupyterLab versions 4.6.0 through 4.6.3 Notebook versions 7.5.0 through 7.6.2 JupyterLite Core versions 0.7.0 through 0.8.3 Description The system clipboard cell-paste path accepts attacker-controlled...

PT-2026-102608

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

CVE-2026-102675: Origin Validation Error

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme registered with supportFetchAPI...

PT-2026-102710

Name of the Vulnerable Software and Affected Versions Electron versions prior to 41.10.6 Electron versions prior to 42.9.2 Electron versions prior to 43.4.1 Electron versions prior to 44.0.0-beta.5 Description Responses served through the protocol.registerFileProtocol or...

CVE-2026-82804: Improper Neutralization of Special Elements used in an OS Command

The scriptPath parameter is incorporated into a /bin/sh -c command without sufficient neutralization of shell metacharacters, allowing shell command substitution and execution. An authenticated user can exploit this behavior by creating a resource whose filename contains shell command substitutio...

PT-2026-102671

Name of the Vulnerable Software and Affected Versions serialize-javascript versions 7.1.1 through 7.1.1 Description serialize-javascript converts JavaScript values into a JSON superset that includes functions and regular expressions. A flaw exists where function values are not fully protected...

Malicious code in test-agency-assignment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcdf62e1c1eb44ca7a29ed37c12bdb71883025a46c5066e58c9228f0dfe782c2 package.json declares a postinstall lifecycle script wscript.exe 4444.vbs, causing the VBS file shipped in the tarball to run automatically on npm...