MAL-2026-12454 Malicious code in statist-browser-typed-client-social.shorts.editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d101df1fd006e045b5062c0a32bea28917d6c3e71d80fe463588b35a0818c416 On require/import of this package, index.js unconditionally loads runtime.js, which fetches a platform-selected binary from rotating Cloudflare Worke...

Malicious code in hubert-verify-primary-email-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6b673dd1185ee4ae8ee19ec605dc7f25eebf55c0583be7c5cb878d331e70db3 [email protected] presents itself as an email-verification library but on require of index.js loads init.js, which reconstructs...

Malicious code in william-data-formatter-x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df0b15d8ca8cdfac8baf861a2db501b3b52eb0e41fd44a6690c351bda8c90835 The package declares a preinstall script node index.js that, on Windows, spawns a hidden PowerShell window -WindowStyle Hidden to fetch...

Malicious code in tinkoff-statist-web-typed-client-test.golden.retriever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 352e7120bec31271d79af9befe17a46024f5785ffca010335fa13eb40c946e3a On require of the package, index.js loads init.js which reconstructs attacker-controlled hostnames via array-join string obfuscation four...

Malicious code in tinkoff-statist-browser-typed-client-sme.rko.origsmartphonepaytb.common.mobile.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e1202cc47d9e9135b8b86db17305d80e50b516ef5e77ebd1771a1c5184b6cb8 The package's index.js unconditionally requires./loader, which on load fetches a platform-specific executable from Cloudflare Workers endpoints...

EUVD-2026-53044

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability CWE-428. An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges...

CVE-2026-66839

CVE-2026-66839 concerns NetKids iMark from Integrated Systems Technologies, Inc., with an Unquoted Search Path or Element (CWE-428). The issue allows an authenticated attacker to execute arbitrary code with SYSTEM privileges via a local attack vector. Affected software is specified as NetKids iMa...

CVE-2026-66344

Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2026-66344.

CVE-2026-66344

NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability CWE-427. An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges...

httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service.

A flaw was found in the Apache HTTP Server's modhttp2 module. This vulnerability, known as a Use After Free, occurs when the server's file handles are exhausted. An attacker could potentially exploit this to cause a denial of service or, in some cases, execute arbitrary code, leading to system...

httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service.

A flaw was found in the Apache HTTP Server's modhttp2 module. This vulnerability, known as a Use After Free, occurs when the server's file handles are exhausted. An attacker could potentially exploit this to cause a denial of service or, in some cases, execute arbitrary code, leading to system...

The vulnerability of the escape() function in the sql-string.js ORM library by Sequelize allows a attacker to execute arbitrary SQL code.

The vulnerability of the escape function in the sql-string.js ORM library by Sequelize is related to the lack of security measures taken to protect the SQL query structure when processing TODATE and TOTIMESTAMP parameters. Exploiting this vulnerability could allow an attacker to execute arbitrary...

CVE-2026-67979

Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via placing a shared object on target storage...

CVE-2026-51400

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vmsfixfilename function within file vim/src/osvms.c...

CVE-2026-51401

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vmsfixfilename function within file vim/src/osvms.c...

UBUNTU-CVE-2026-51400

An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vmsfixfilename function within file vim/src/osvms.c...

CVE-2026-18657 Executable Resolution from Untrusted Project Directory in Kiro CLI on Windows

An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user starts Kiro CLI in...

Arbitrary Code Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection via the run method in the CSVAgents class. An attacker can execute arbitrary code in the context of the server process by sending crafted prompts to a chatflow using the CSV Agent...

Arbitrary Code Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via the run method in the CSVAgents class. An attacker can execute arbitrary code in the context of the server process by sending crafted prompts to a chatflow using...

CVE-2026-70477 Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, a prompt injection sent to a chatflow using a CSV Agent node can cause the LLM to respond with a malicious Python script that bypasses the blocklist validator and executes in an unsandboxed...