Malicious code in @pwaplatform/module-sso-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f674867f67f5a8495dbc953913b6cc7c0d8b9d094161c660ca4dfd5449506ba @pwaplatform/[email protected] declares both preinstall and postinstall lifecycle scripts that execute payload.js on npm install...

PT-2026-95957

Name of the Vulnerable Software and Affected Versions getID3 versions prior to 1.9.26 Description An OS command injection flaw exists in shell-out handlers that fail to properly escape filenames before incorporating them into command strings. Attackers can use filenames containing shell...

PT-2026-95973

Name of the Vulnerable Software and Affected Versions 0-Gaurav-0 nexus-mcp affected versions not specified Description Command injection is possible in the nexus reauth MCP tool within the file src/auth/browser.ts. The issue occurs when the url argument is passed to the child process.exec functio...

SUSE CVE-2026-55765

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and...

CVE-2026-93922

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens,...

CVE-2026-93922: Improper Neutralization of Input During Web Page Generation

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens,...

Linux Distros Unpatched Vulnerability : CVE-2026-61817

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, runmaintenance, showpartitions, showpartitioninfo,...

Linux Distros Unpatched Vulnerability : CVE-2026-61820

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherittemplateproperties manually surrounds primary-key colu...

Linux Distros Unpatched Vulnerability : CVE-2026-61819

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pgjobmon is installed and partconfig.jobmon is true,...

Linux Distros Unpatched Vulnerability : CVE-2026-61781

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, createpartitiontime reads the writable partconfig.timeencoder...

CVE-2026-93922 SiYuan through 3.8.4 Stored XSS via notebook names

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens,...

CVE-2026-93922

SiYuan through 3.8.4 contains a stored cross-site scripting flaw in the Daily Note picker dialog , where notebook names are rendered as raw HTML without escaping. An attacker can create a notebook whose name contains an HTML/JS payload; when a victim opens the picker, the script executes inside t...

CVE-2026-93922 SiYuan through 3.8.4 Stored XSS via notebook names

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens,...

CVE-2026-93922 SiYuan through 3.8.4 Stored XSS via notebook names

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens,...

CVE-2026-68928

Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/src/android/TerminalService.java does no...

CVE-2026-68928 Acode: Exported TerminalService (bundled terminal plugin) lets any installed app execute arbitrary shell commands as Acode

Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/src/android/TerminalService.java does no...

EUVD-2026-83444

Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/src/android/TerminalService.java does no...

CVE-2026-68928 Acode: Exported TerminalService (bundled terminal plugin) lets any installed app execute arbitrary shell commands as Acode

Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/src/android/TerminalService.java does no...

CVE-2026-68928

Acode is a text and code editor for Android. In versions 1.11.6 through 1.12.7 , the bundled terminal plugin's TerminalService is declared as an exported service without a binding permission, and the service implementation does not verify the calling application. Any locally installed app can bin...

CVE-2026-68928 Acode: Exported TerminalService (bundled terminal plugin) lets any installed app execute arbitrary shell commands as Acode

Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported service in src/plugins/terminal/plugin.xml without a binding permission, and src/plugins/terminal/src/android/TerminalService.java does no...