CVE-2026-51366

SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the apivedo/chat endpoint and the utentechat parameter...

PT-2026-78368

Name of the Vulnerable Software and Affected Versions Zoo versions prior to 4.1.64 Description An open redirect exists in the CommentController::twitterAuthenticate function. The issue occurs because the referer request parameter is passed directly to the setRedirect function without proper...

PT-2026-78287

Name of the Vulnerable Software and Affected Versions Product Shortlist WordPress plugin versions prior to 1.0.5 Description An issue exists where a parameter is not properly sanitized and escaped before being used in a SQL statement. This allows unauthenticated attackers to execute SQL injection...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: bind (UTSA-2026-102687)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102687 advisory. A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able...

MiracleLinux 9 : php:8.2 (AXSA:2026-1579:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1579:01 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Tenable has extracted the preceding description...

PT-2026-78804

In versions below 2.5.3 of the Azure AD Graph app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temp password parameter is not masked and is shown in cleartext in the user...

RHEL 9 : php:8.3 (RHSA-2026:48197)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:48197 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: PHP OpenSSL extension: Denial of Service...

Linux Distros Unpatched Vulnerability : CVE-2026-23929

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Prototype pollution vulnerability in searchParamsToObject is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous propertie...

AlmaLinux 9 : php:8.2 (ALSA-2026:40416)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:40416 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.2.32 for...

PT-2026-78808

In versions below 1.5.2 of the MS Graph for Active Directory app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive password by invoking the reset password action, because the action's temp password parameter is not masked and is shown in cleartext in...

Malicious code in lodsh-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2803016f5b10510cdb31304197a1670396290e9be96fe647fd6c505d1f487273 lodsh-cli is a typosquat of lodash-cli. Its scripts/postinstall.js runs automatically on npm install and performs two hostile actions. First, it...

MAL-2026-14184 Malicious code in lodsh-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2803016f5b10510cdb31304197a1670396290e9be96fe647fd6c505d1f487273 lodsh-cli is a typosquat of lodash-cli. Its scripts/postinstall.js runs automatically on npm install and performs two hostile actions. First, it...

MAL-2026-14180 Malicious code in lodahs-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15cec128c194761de8cd73923062ece7e4104b5e6130ca40882c5ac9d3f83914 The postinstall lifecycle script in scripts/postinstall.js executes automatically on npm install and performs three attacker-benefiting actions. Firs...

Malicious code in lodahs-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15cec128c194761de8cd73923062ece7e4104b5e6130ca40882c5ac9d3f83914 The postinstall lifecycle script in scripts/postinstall.js executes automatically on npm install and performs three attacker-benefiting actions. Firs...

Malicious code in commandor-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75d139bce34f1d3290c34bb6da1c421bb579afb93672b44909ed0725eb70be3c The postinstall script in [email protected] scripts/postinstall.js XOR-decodes a hardcoded URL using key 'stf2026' that resolves to...

MAL-2026-14172 Malicious code in commandor-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75d139bce34f1d3290c34bb6da1c421bb579afb93672b44909ed0725eb70be3c The postinstall script in [email protected] scripts/postinstall.js XOR-decodes a hardcoded URL using key 'stf2026' that resolves to...

Malicious code in dev-env-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad3f3a3d73b4142f210049e2461cc3b808cb3b8f08b50f2fa2cbf661bf288b35 On install, lib/platform-compat.js runs from the postinstall hook and, on Windows, uses powershell.exe Invoke-WebRequest with -WindowStyle Hidden,...

MAL-2026-14176 Malicious code in dev-env-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad3f3a3d73b4142f210049e2461cc3b808cb3b8f08b50f2fa2cbf661bf288b35 On install, lib/platform-compat.js runs from the postinstall hook and, on Windows, uses powershell.exe Invoke-WebRequest with -WindowStyle Hidden,...

Malicious code in ladash-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d1b70674c7273e350d033cacec46a4981aebced798342e3b28da3dcd52a34bb ladash-cli is a one-character typosquat of lodash-cli whose main entry exports an empty object; the only functional code is scripts/postinstall.js,...

MAL-2026-14178 Malicious code in ladash-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d1b70674c7273e350d033cacec46a4981aebced798342e3b28da3dcd52a34bb ladash-cli is a one-character typosquat of lodash-cli whose main entry exports an empty object; the only functional code is scripts/postinstall.js,...