9804 matches found
Malicious code in @sheltr_/agent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ecc4dcd6d76f100601f8b37a6b9c3aab899770ab361f2714f9193a2f8d0db78 When the package's bin entry is run, it spawns an interactive PTY shell using $SHELL with the user's full process environment and HOME as the working...
MAL-2026-10265 Malicious code in abuden224 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4b6da7762075dee890b0878af8420637eed76f394f658992c5e10454e09e1e2 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
MAL-2026-10260 Malicious code in abuden217 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42fce03517a0e7a241f99d0ce806a5bb90a4f70b083a2997c80868f3bc37d4b4 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
MAL-2026-10320 Malicious code in ishowfeet18 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08f04a1305b1d162f7958092deffd5a8ad485daf0d64b2d52b26c92d5f1a1db2 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
MAL-2026-10358 Malicious code in nottuff6 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31a4e89de7dc0db67a1f6c404dc1b6b0b418cd8207e71ad82ef8d2027acb7ea9 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
MAL-2026-10273 Malicious code in abuden24 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb51631494082c47eae9693ef57def77cbb5e4ecef742b0e1cf5ac6f41b4573f The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...
Malicious code in auto-debug-tool (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dd31c11b5149d8dd2142c81cc066576dc799ba4dae4599a9569cb56256417ec package.json declares a postinstall hook node install.js that fires automatically on npm install. On Windows, install.js invokes hidden PowerShell -N...
PT-2026-63656
Name of the Vulnerable Software and Affected Versions PhpSpreadsheet affected versions not specified Description The OLE reader in PhpSpreadsheet follows sector chains from XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A malformed file can set the small-block depo...
Improper Handling of Highly Compressed Data (Data Amplification)
Overview httplib2 is a small HTTP client library for Python. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the decompressContent function in httplib2/init.py. An attacker can exhaust memory and crash the client by sendin...
Missing Authorization
Overview ironic is an OpenStack Bare Metal Provisioning Affected versions of this package are vulnerable to Missing Authorization in the sendraw process. An attacker can gain unauthorized control over hardware or cause a system outage by sending arbitrary IPMI commands to the BMC. This is only...
automatic-goggles (>=0.1.0, <=0.8.0) potentially affected by CVE-2025-12695 via dspy (2.6.8)
dspy PYPI version 2.6.8 is affected by a known vulnerability. The following packages have a transitive dependency on dspy and may be impacted: - automatic-goggles =0.1.0, =0.8.0 Source cves: CVE-2025-12695 Source advisory: OSV:PYSEC-2026-1318...
[SECURITY] Fedora 43 Update: clamav-1.4.5-1.fc43
Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...
CVE-2026-55698
A flaw was found in pnpm, a package manager. This vulnerability allows a remote attacker to achieve arbitrary code execution by committing a specially crafted package-manager lockfile pnpm-lock.yaml to a repository. When pnpm is executed, it trusts an already resolved packageManagerDependencies...
Cross-site Request Forgery (CSRF)
Overview webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the open-editor and invalidate endpoints. An attacker can open...
CVE-2026-11586
The curl software and its libcurl library are vulnerable to a memory exhaustion attack via the WebSocket component. By default, curl automatically responds to WebSocket PING frames; however, it lacks an upper bound on memory allocation for unacknowledged frames. A malicious server can exploit thi...
PT-2026-55445
Name of the Vulnerable Software and Affected Versions coder versions prior to 2.29.7 coder versions prior to 2.30.2 Description A command injection issue exists in the dotfiles registry module where unsanitized user input is passed to shell commands. An attacker can provide a crafted dotfiles uri...
Fedora 45 : ipp-usb (2026-7eaf5e3510)
The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7eaf5e3510 advisory. Automatic update for ipp-usb-0.9.34-2.fc45. Changelog Tue Jun 30 2026 Zdenek Dohnal - 0.9.34-2 - ipp-usb-0.9.34 is available fedora2463247,...
Fedora 45 : jq (2026-b43264dedb)
The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-b43264dedb advisory. Automatic update for jq-1.8.2-4.fc45. Changelog Sat Jun 20 2026 Filipe Rosset - 1.8.2-4 - removed old upstreamed patches Sat Jun 20 2026 Filipe Ross...
PT-2026-53469
Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme url SSRF and creator-equality IDOR Vulnerability Summary Field | Value -- | -- Title | Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access vi...
