Malicious code in @angulra/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ebb04f93b463536e56e0160e0e1fc2748d69c9eb15f991e990365cee7852a34 The package.json preinstall script runs curl -L...

MAL-2026-17495 Malicious code in @angulra/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3158beab2ea0d9f8e28d488f124268c8c9a00a3a0f5599823c4d13f741ac40f The package name @angulra/cli is a character-swap of @angular/cli and copies the legitimate Angular CLI's metadata description, repository, homepage,...

Malicious code in @angulra/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3158beab2ea0d9f8e28d488f124268c8c9a00a3a0f5599823c4d13f741ac40f The package name @angulra/cli is a character-swap of @angular/cli and copies the legitimate Angular CLI's metadata description, repository, homepage,...

CVE-2026-105220

Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file,...

MAL-2026-17474 Malicious code in core-js-gnz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc57686b95f827f2c3b0501d97b6575e077247255bf5d4227ae9bc8bedd43937 On install, package.json runs node init.js as a postinstall hook. init.js collects host identifiers os.hostname, os.userInfo.username, os.platform,...

Malicious code in core-js-gnz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc57686b95f827f2c3b0501d97b6575e077247255bf5d4227ae9bc8bedd43937 On install, package.json runs node init.js as a postinstall hook. init.js collects host identifiers os.hostname, os.userInfo.username, os.platform,...

CVE-2026-105220

A flaw was found in Twine. The application fails to properly sanitize markup during story import, allowing embedded malicious scripts to execute within the editor interface. By convincing a user to import a specially crafted story file, an attacker can leverage an internal inter-process...

CVE-2026-105220 Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files

Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file,...

CVE-2026-105220 Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files

Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file,...

CVE-2026-105220

Twine 2 Desktop (versions through 2.12.0 ) is vulnerable to Arbitrary Code Execution due to a cross-site scripting (XSS) flaw in the importStories() function. The root cause is a failure to properly sanitize markup during the import of story files, which allows malicious scripts to execute within...

CVE-2026-105220 Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files

Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file,...

[SECURITY] [DSA 6541-1] wireshark security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6541-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 04, 2026 https://www.debian.org/security/faq -...

Debian dsa-6541 : libwireshark-data - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6541 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6541-1 [email protected] https://www.debian.org/securit...

Fedora 45 : python-uv-build / ruff / rust-libcst / rust-libcst_derive / etc (2026-d1044d27b7)

The remote Fedora 45 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2026-d1044d27b7 advisory. Update the libcst/libcstderive crates to 1.9.0. Update the salsa/salsa- macros/salsa-macro-rules crates to 0.28.5, fixing a use-after-free bug, GHSA-...

[SECURITY] [DLA 4816-1] pcre2 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4816-1 [email protected] https://www.debian.org/lts/security/ Salvatore Bonaccorso October 03, 2026 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 4815-1] freecad security update

Debian LTS Advisory DLA-4815-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost October 03, 2026 https://wiki.debian.org/LTS Package : freecad Version : 0.20.2+dfsg1-4+deb12u1 CVE ID : CVE-2026-34789 CVE-2026-73234 CVE-2026-73235 Debian Bug : 1144349 Three...

SUSE CVE-2026-103484

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution...

CVE-2026-103065 WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability

Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1...

CVE-2026-103065 WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability

Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1...

CVE-2021-22204

CVE-2021-22204 - ExifTool 任意代码执行 这是针对 CVE-2021-22204 的升级版概念验证（PoC），该漏洞影响 ExifTool 7.44 至 12.23 版本，在处理恶意 DjVu 文件时可导致任意代码执行。 致谢 本文为衍生作品。该漏洞及原始利用代码并非本人所发现。 角色| 人员 ---|--- 漏洞发现者| William Bowling @wcbowling，通过 GitLab 漏洞赏金计划提交 — 2021 年 4 月 原始 PoC 作者| UNICORD NicPWNs & Dev-Yeoj 本仓库修改者| d4ytox 描述 ExifToo...