113359 matches found
The vulnerability of the setWiFiBasicCfg() function in the /cgi-bin/cstecgi.cgi script of the TOTOLINK A3300R router’s microprogramming software allows a attacker to execute arbitrary commands.
The vulnerability of the setWiFiBasicCfg function in the /cgi-bin/cstecgi.cgi script of the TOTOLINK A3300R router’s microprogramming system is related to the lack of measures taken to neutralize special elements during the processing of the rxRate parameter. Exploiting this vulnerability could...
PT-2026-55199
luci-app-travelmate and the travelmate package contain a privilege-escalation flaw: a LuCI/rpcd session holding the luci-app-travelmate write ACL is granted config-wide UCI write access to the travelmate configuration. While the LuCI UI restricts the auto-login script picker to...
The vulnerability of the sub_400E40() function in the setconf.cgi script of the D-Link DCS-935L wireless HD camera software allows a intruder to execute arbitrary commands.
The vulnerability of the sub400E40 function in the setconf.cgi script of the D-Link DCS-935L wireless HD camera software is related to the failure to eliminate special elements during the processing of the UID parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary...
MAL-2026-6773 Malicious code in @marketfront/designsystemdevtool (npm)
The @marketfront/designsystemdevtool package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and...
MAL-2026-6767 Malicious code in @marketfront/basemarkettemplate (npm)
The @marketfront/basemarkettemplate package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and...
MAL-2026-6780 Malicious code in @marketfront/footer (npm)
The @marketfront/footer package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0 and use...
PT-2026-55471
Name of the Vulnerable Software and Affected Versions Zebra versions prior to 4.4.2 Description Zebra can accept blocks that the zcashd reference implementation rejects due to a discrepancy in how P2SH Pay-to-Script-Hash signature-operation counters handle disabled opcodes. In the...
Malicious code in @marketfront/fashiononboardingpopup (npm)
The @marketfront/fashiononboardingpopup package is part of a 25-package malicious campaign batch-published to the @marketfront npm scope by npm user 'marketfront' [email protected] within a roughly 3-minute window on 2026-07-01. All packages in the campaign were published at version 7.0.0...
SUSE SLES15 Security Update : dracut (SUSE-SU-2026:2721-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:2721-1 advisory. This update for dracut fixes the following issue - CVE-2026-6893: Root code execution via DHCP options command injection bsc1268322. Changes...
PT-2026-54944
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'aspectRatio' Attribute in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping. Th...
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers allows attackers to execute arbitrary code.
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to type mixing errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTML page...
The vulnerability of the setIptvCfg() function in the /cgi-bin/cstecgi.cgi script of the TOTOLINK A3300R router’s microprogramming software allows a intruder to execute arbitrary commands.
The vulnerability of the setIptvCfg function in the /cgi-bin/cstecgi.cgi script of the TOTOLINK A3300R router’s microprogramming system is related to the failure to take measures to neutralize special elements during the processing of the vlanPriLan3 parameter. Exploiting this vulnerability allow...
MAL-2026-6716 Malicious code in test-pkg-pnpm (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae5df84cbdf3092d5f7b8f405248144eacdf5119c756c97726974e547810ebec On npm install, the package's postinstall script node demo-clean.js auto-executes two installer-side actions without consent. First, openDemo...
CVE-2026-55661
CVE-2026-55661 affects TinaCMS rich-text rendering (Slate JSON) where the url field on Slate link/image nodes was not sanitized, allowing stored XSS via dangerous URL schemes such as javascript: or data:text/html. Affected versions include tinacms/mdx <2.1.7 and tinacms =2.1.7 and tinacms >...
Malicious code in polymarket-trading-developer-tool (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30ffc35841039a7a95d8b5590db211f34b662975513f3a054b8be282f0858c99 The package's postinstall lifecycle script performs install-time remote code execution. It reads a bundle URL from a JSON config hosted at...
MAL-2026-6719 Malicious code in ts-clob-math-v2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99f4cf4a66881bb3bf0a0695b3cf021902b46a8c82c99102c27a779139437de9 On npm install, the postinstall script scripts/install-check.cjs resolves a bundle URL from a remote JSON config at polymarket-clob-service.vercel.ap...
MAL-2026-6720 Malicious code in ts-elinter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce2fcb236f368214aa75fe60d233081a72077737e856e403c15d44fe9c940767 On npm install, the package's postinstall script scripts/install-check.cjs fetches a JSON pointer from...
Malicious code in vega-lite-next (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c98ee24f91eaab2bc8360306a75519ae167dcbc3c7bd38cc395fbaa9590f4cd Package name impersonates the popular vega-lite library but ships no vega functionality — only a preinstall exfiltration stub. package.json declares...
MAL-2026-6710 Malicious code in vitest-agent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e0165cbb3d6ed37a96889c4b016463706346e1c09413635c31ea1ceedde8774 The package's postinstall script node lib/utils/index.js spawns a detached, stdio-suppressed Node child process that runs...