MAL-2026-13490 Malicious code in fast-hashes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 503b750458783954b66f8dea6ee8b0300fd7db5b225280f1af432cf78c1faf6d setup.py defines a custom install command NativeInstall.run that decodes a base64 blob and passes it to execcompile... at install time. The decoded...

Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x_setup()

...

Malicious code in idnna (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da6f2ec3b09fbcf061a9f4ffefe1c179983ad8cdc0af705f2218280ade3c1da3 The package publishes under a name that closely resembles the widely-used idna package and advertises itself as 'HTTP client utilities', but the only...

Malicious code in flasq (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79bdf17d9c07586ddc0b7121037c2c10019d7be01d2dd49685680a8e876342c6 setup.py registers a custom install cmdclass whose post-install hook is stored as a base64-encoded blob and decoded+exec'd at install time. On Linux,...

MAL-2026-13487 Malicious code in flasq (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79bdf17d9c07586ddc0b7121037c2c10019d7be01d2dd49685680a8e876342c6 setup.py registers a custom install cmdclass whose post-install hook is stored as a base64-encoded blob and decoded+exec'd at install time. On Linux,...

heap-pwn-tutorial

Heap Pwn CTF Training Tutorial 3h, beginner A self-containe...

Malicious code in weight2loss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8b80ee1c23ef1ae185bbda67deab7b442f673434427f2c006acb4e7f388a52e The package ships setup.js, referenced by a postinstall hook in package.json, that on execution: 1 reads installer-side secrets from /.npmrc, /.ssh/,...

CVE-2026-48085

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...

EUVD-2026-54167

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...

CVE-2026-48085

OpenReception Open-Source booking software contains an unauthenticated admin account creation flaw in versions prior to 1.0.1. A POST to /setup/create-admin-account allows an unauthenticated attacker to create additional GLOBAL_ADMIN accounts without verifying that an admin already exists. The ne...

CVE-2026-48085 OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...

CVE-2026-48085

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...

CVE-2026-48085 OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...

CVE-2026-48085 OpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...

@ccfly/setup (0.1.2) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.2)

@ccfly/setup-linux-x64 NPM version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.2 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13418...

@ccfly/setup (0.1.19) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.19)

@ccfly/setup-linux-x64 NPM version 0.1.19 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.19 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13418...

@ccfly/setup (0.1.1) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.1)

@ccfly/setup-linux-x64 NPM version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.1 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13418...

@ccfly/setup (0.1.3) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.3)

@ccfly/setup-linux-x64 NPM version 0.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.3 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13418...

@ccfly/setup (0.1.4) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.4)

@ccfly/setup-linux-x64 NPM version 0.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.4 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13418...

@ccfly/setup (0.1.9) potentially affected by unknown CVE via @ccfly/setup-linux-x64 (0.1.9)

@ccfly/setup-linux-x64 NPM version 0.1.9 is affected by a known vulnerability. The following packages have a transitive dependency on @ccfly/setup-linux-x64 and may be impacted: - @ccfly/setup 0.1.9 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13418...