MAL-2026-13828 Malicious code in ms_aidc_com_tw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b12bdd45f103beeee602be82a07277a3f0cb842ec3a9829e904911fe37bd2fd5 The package msaidccomtw ships only an index.html that renders a fake Cloudflare Turnstile 'security verification' page. On Turnstile completion,...

Malicious code in biklimaster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16fe526cf29535e21a0d1c3206405e20d0447ca01f25ea46dc9569ab52066555 The npm postinstall hook node bin/biklimaster.js install --postinstall prompts for UAC elevation and then reconfigures the installer's Windows host...

MAL-2026-13779 Malicious code in @bikli/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 494fd55b20aca27d1d7353454574b7575074d84eee1367b6854c159f274c4dcc No a static rule matches and no traced behavioral findings were produced for this package version. The scanned files contain no evidence of...

Malicious code in biklirouter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa35b0b8fe046a8dd43a4307742214223c3f908b5ba65fa6d24dae18b33cff9b Package ships a compiled Next.js application server routes under app/.next-cli-build/server/app/api/ implementing an LLM/AI-provider router: OAuth...

MAL-2026-13786 Malicious code in biklimaster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16fe526cf29535e21a0d1c3206405e20d0447ca01f25ea46dc9569ab52066555 The npm postinstall hook node bin/biklimaster.js install --postinstall prompts for UAC elevation and then reconfigures the installer's Windows host...

Malicious code in @bikli/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 494fd55b20aca27d1d7353454574b7575074d84eee1367b6854c159f274c4dcc No a static rule matches and no traced behavioral findings were produced for this package version. The scanned files contain no evidence of...

MAL-2026-13787 Malicious code in biklirouter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa35b0b8fe046a8dd43a4307742214223c3f908b5ba65fa6d24dae18b33cff9b Package ships a compiled Next.js application server routes under app/.next-cli-build/server/app/api/ implementing an LLM/AI-provider router: OAuth...

Security Bulletin:Vulnerability in OpenSSL affects IBM Netezza Appliance

Summary The OpenSSL package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-42770 Vulnerability Details CVEID:CVE-2026-42770 DESCRIPTION: Issue summary: When EVPPKEYderivesetpeer is called with a DHX X9.42 peer key, the peer key is not properly...

Exploit for Use After Free in Linux Linux_Kernel

SM-F9360 Galaxy Z Fold4 / q4q Bootloader-Free KernelSU Root...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.52 security and extras update

Red Hat OpenShift Container Platform release 4.18.52 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a security impact of Low...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.42 security and extras update

Red Hat OpenShift Container Platform release 4.19.42 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a security impact of Low...

CVE-2026-19594

Insufficient input sanitization in Snowflake Python API snowflake.core versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal CWE-22 via unencoded .. identifier path segments, and HTTP parameter pollution CWE-141 via unencoded &//=...

CVE-2026-18474

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured...

CVE-2026-18230

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks...

CVE-2026-17013

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...

React Native Community CLI - Unauthenticated OS Command Injection

The Metro development server started by the React Native Community CLI binds to external network interfaces by default and exposes an unauthenticated /open-url endpoint. Affected versions pass the attacker supplied url value straight to the open helper without validating the scheme, allowing an...

rConfig 3.9 - SQL Injection

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter. id: CVE-2020-10220 info: name: rConfig 3.9 - SQL Injection author: ritikchaddha,theamanrawat severity: critical description: | An issue was discovered i...

Wing FTP Server <= 7.4.3 - Remote Code Execution

Wing FTP Server versions prior to 7.4.4 are vulnerable to an unauthenticated remote code execution RCE flaw CVE-2025-47812. The vulnerability arises from improper NULL byte handling in the 'username' parameter during login, which allows Lua code injection into session files. These injected sessio...

ThinkPHP 5.0.23 - Remote Code Execution

An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\think\Request/input&filter=phpinfo&data=1 query string. id: CVE-2018-20062 info: name: ThinkPHP...

WordPress Paid Memberships Pro <2.9.8 - Blind SQL Injection

WordPress Paid Memberships Pro plugin before 2.9.8 contains a blind SQL injection vulnerability in the 'code' parameter of the /pmpro/v1/order REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of th...