(Pwn2Own) QNAP TS-453E malware_remover Code Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of QNAP TS-453E devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the malwareremover.cgi endpoint. The issue results from the lack of prope...

(Pwn2Own) QNAP TS-453E Hyper Data Protector Plugin Hard-Coded Credentials Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of QNAP TS-453E devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of Bareos by the Hyper Data Protector Plugin. The issue...

(Pwn2Own) QNAP TS-453E conn_log_tool Format String Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of QNAP TS-453E devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling ...

(Pwn2Own) QNAP TS-453E nvrlog_event_add msg SQL Injection Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of QNAP TS-453E devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling ...

PT-2026-25543

A security vulnerability has been detected in CodeGenieApp serverless-express up to 4.17.1. Affected by this issue is some unknown functionality of the file examples/lambda-function-url/packages/api/models/TodoList.ts of the component API Endpoint. The manipulation of the argument userId leads to...

CVE-2026-3965 whyour qinglong API express.ts protection mechanism

A security vulnerability has been detected in whyour qinglong up to 2.20.1. Affected is an unknown function of the file back/loaders/express.ts of the component API Interface. The manipulation of the argument command leads to protection mechanism failure. The attack may be initiated remotely. The...

CVE-2026-3965

CVE-2026-3965 affects whyour qinglong up to 2.20.1, with the vulnerability located in the back/loaders/express.ts API Interface. The issue arises from manipulation of the command argument, causing protection mechanism failure and enabling remote access. Public exploit information exists, and ther...

MAL-2026-1344 Malicious code in bignum-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7424fa86053a143f5eae6585268b643e7b473544dfb04279e159857d32ee3565 The package bignum-ts was found to contain malicious code. Source: ghsa-malware 91982cc34a885d97932c4e298eae656831e28ca39aa3b19ac261f368647056d3 Any...

Malicious Package

Overview bignum-ts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in bignum-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7424fa86053a143f5eae6585268b643e7b473544dfb04279e159857d32ee3565 The package bignum-ts was found to contain malicious code. Source: ghsa-malware 91982cc34a885d97932c4e298eae656831e28ca39aa3b19ac261f368647056d3 Any...

Malicious code in ts-lint-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4411e0cabacba0eb0996243c3198a26f74deb52ec249ba39f1b8019fea10136 The package ts-lint-builder was found to contain malicious code. Source: ghsa-malware 0514225155e8ef3ef5350ff238e097dd627e4dd2639974c7cab656ad65d3f6b...

Malicious Package

Overview ts-lint-builder is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1346 Malicious code in ts-lint-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4411e0cabacba0eb0996243c3198a26f74deb52ec249ba39f1b8019fea10136 The package ts-lint-builder was found to contain malicious code. Source: ghsa-malware 0514225155e8ef3ef5350ff238e097dd627e4dd2639974c7cab656ad65d3f6b...

EUVD-2024-55475

A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in th...

PT-2026-24596

🚨 CVE-2024-14026 A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the...

QNAP Systems QTS和QNAP Systems QuTS hero 安全漏洞

QNAP Systems QTS and QNAP Systems QuTS hero are software products with data storage and management functions developed by QNAP Systems, a company based in Taiwan, China. Both QNAP Systems QTS and QNAP Systems QuTS hero have security vulnerabilities; these vulnerabilities stem from command injecti...

EUVD-2026-10493

SQL Injection CWE-89 in the system configuration module in Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux allows remote attackers to execute arbitrary SQL commands and potentially achieve remote code execution via specially crafted SQL requests...

CVE-2026-3843

CVE-2026-3843 affects Nefteprodukttekhnika BUK TS-G Gas Station Automation System (Linux) version 2.9.1. The flaw is a SQL Injection in the system configuration module, exploitable via HTTP POST to /php/request.php with the sql parameter (example: action=do&sql=&reload_driver=0), potentially enab...

PT-2026-24203

Name of the Vulnerable Software and Affected Versions Nefteprodukttekhnika BUK TS-G Gas Station Automation System version 2.9.1 Description The system contains a SQL Injection issue in the system configuration module. An attacker can send crafted HTTP POST requests to the /php/request.php endpoin...

CVE-2026-3843: Improper Neutralization of Special Elements used in an SQL Command

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability CWE-89 in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter in...