MAL-2026-12279 Malicious code in tinkoff-statist-web-typed-client-test.golden.retriever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 352e7120bec31271d79af9befe17a46024f5785ffca010335fa13eb40c946e3a On require of the package, index.js loads init.js which reconstructs attacker-controlled hostnames via array-join string obfuscation four...

MAL-2026-12230 Malicious code in tinkoff-boxy-desktop-two-panel-right-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a347918d0341f95fdb00b2e148c6709be7d7126be5f629ce9515d2349624246 On require of this package, index.js loads vendor.js which detects the host OS/arch, assembles destination hostnames from split string fragments...

MAL-2026-12161 Malicious code in bigops-communication-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81c94eee2da1d74fc50236452fc79165eb1183ce0bb874a62a9a7985b6e77206 On require of the package, index.js loads platform.js which invokes init at module top level. init downloads an opaque binary from Cloudflare Workers...

CVE-2026-7693

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the file POST parameter on the restoreBackup AJAX handler. The handler applies escattr — an HTML-context sanitizer that does not strip...

CVE-2026-64577

In the Linux kernel, the following vulnerability has been resolved: gtp: check skbpulldata return in gtp1usendechoresp gtp1usendechoresp ignores skbpulldata's return value. Its caller gtp1uudpencaprecv only guarantees 16 bytes udphdr + gtp1header, but the pull requests 20 gtp1headerlong + udphdr...

CVE-2026-64575

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpfitertcpbatch releases the current batch via bpfitertcpputbatch, which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cursk/endsk ar...

CVE-2026-70374

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extnamefilename and passes it, unescaped, into a...

CVE-2026-71207

The Stock-Inventory-Management-System is affected in login.php, where raw $_POST values are assigned to $_SESSION and concatenated into a SQL query without parameterization, enabling unauthenticated SQL injection. An attacker could bypass authentication by submitting payloads like ' OR '1'='1, le...

CVE-2026-54416

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php '.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar', checked against the last 4-5 characters of the...

Multiple vulnerabilities in NetKids iMark

Overview NetKids iMark provided by Integrated Systems Technologies, Inc. contains multiple vulnerabilities listed below: Uncontrolled search path element CWE-427 - CVE-2026-66344 Unquoted search path or element CWE-428 - CVE-2026-66839 Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported...

CVE-2026-7693 Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter

The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 2.1.5.1 due to insufficient sanitization of the file POST parameter on the restoreBackup AJAX handler. The handler applies escattr — an HTML-context sanitizer that does not strip...

CVE-2026-66839

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability CWE-428. An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges...

CVE-2026-66344

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability CWE-427. An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges...

CVE-2026-70375 HashBrown CMS - OS Command Injection via Git Deployer Branch Field

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping...

EUVD-2026-53097

HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability CWE-78 in the media upload thumbnail generation routine. Media.generateThumbnail in src/Server/Entity/Resource/Media.js builds a temporary file path as 'thumbnail' + Path.extnamefilename and passes it, unescaped, into a...

CVE-2026-67592

Removed by vendor...

CVE-2026-67590

Removed by vendor...

CVE-2026-71192

In OpenStack Swift through 2.38.0, the S3API middleware does not sanitize Swift-native control headers X-Copy-From, X-Copy-From-Account from S3 API requests when s3acl=true. An attacker can inject these headers into a signed PUT request targeting their own bucket, causing Swift to perform a...

EUVD-2026-53044

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability CWE-428. An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges...

CVE-2026-66839

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability CWE-428. An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges...