MAL-2026-13594 Malicious code in dolyame-ui-postcssconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector beadfa2b3e85781a408e7ecf6c37dc663a318fa807de81a01f85add1e195cc51 On require of the package, index.js loads polyfill.js and lib/telemetry.js, both of which fetch a platform-specific binary over HTTPS from one of fou...

CVE-2026-13346

A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to...

CVE-2026-13346 pip absolute path traversal during download from malicious package indexes

pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone...

EUVD-2019-0229

Malware in sbrugna...

EUVD-2019-0306

Malware in sbrugna...

EUVD-2019-0209

Malware in sbrugna...

EUVD-2019-0264

Malware in sbrugna...

EUVD-2019-0200

Malware in sbrugna...

[SECURITY] Fedora 36 Update: golang-x-exp-0-0.43.20220330git053ad81.fc36

This subrepository holds experimental and deprecated packages. The idea for this subrepository originated as the pkg/exp directory of the ma in repository, but its presence there made it unavailable to users of the binary downloads of the Go installation. The subrepository has therefore been...

[SECURITY] Fedora 36 Update: golang-x-exp-0-0.42.20220330git053ad81.fc36

This subrepository holds experimental and deprecated packages. The idea for this subrepository originated as the pkg/exp directory of the ma in repository, but its presence there made it unavailable to users of the binary downloads of the Go installation. The subrepository has therefore been...

Resourcehacker Remote Code Execution Vulnerability

resourcehacker is an executable resource editor for the Windows platform. A security vulnerability exists in resourcehacker that originates when the program downloads binary resources over the HTTP protocol. A remote attacker could exploit the vulnerability by replacing the requested binary with ...

xd-testing Remote Code Execution Vulnerability

xd-testing is a set of test libraries for testing applications across devices. A security vulnerability exists in xd-testing that originates when a program downloads binary resources over the HTTP protocol. A remote attacker could exploit the vulnerability by replacing the requested binary with a...

sfml Remote Code Execution Vulnerability

sfml is a set of multimedia development libraries that provide simple interfaces to various components of a PC, simplifying the development of multimedia applications. A security vulnerability exists in sfml that originates when a program downloads binary resources over the HTTP protocol. An...

msystem Remote Code Execution Vulnerability

msystem is a package used in Node.js for downloading and installing the MyStem morphological text analyzer. A security vulnerability exists in msystem that originates when the program downloads binary resources over the HTTP protocol. A remote attacker could exploit the vulnerability by replacing...

Man-in-the-middle attack vulnerability in node-thulac

node-thulac is a Chinese participle tool. A security vulnerability exists in node-thulac, which originates when the program downloads binary resources over the HTTP protocol. A remote attacker can exploit the vulnerability by replacing the requested binary with an attacker-controlled binary to...

CVE-2016-10684

healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if t...

CVE-2016-10663

wixtoolset is a Node module wrapper around the wixtoolset binaries wixtoolset downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlled copy if the...

CVE-2016-10665

herbivore is a packet sniffing and crafting library. Built on libtins herbivore 0.0.3 and below download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources with an attacker controlle...

CVE-2016-10645

grunt-images is a grunt plugin for processing images. grunt-images downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested binary with an attacker controlled binary if the attacker is on...

PT-2018-4850

Name of the Vulnerable Software and Affected Versions cloudpub-redis versions affected versions not specified Description The issue allows for potential remote code execution RCE due to the insecure download of binary resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. I...