Malicious code in python-walletlibr-v (PyPI)

Source: amazon-inspector 6783cffec9c8f9377babacd1cb4490a278bace564b34861bf49b35258be7220c python-walletlibr-v is a wallet-lookalike PyPI package that ships no wallet functionality — only a stub hello that prints 'Hello from my custom library!' and placeholder author metadata author = 'Your Name'...

MAL-2026-14488 Malicious code in python-walletlibr-v (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6783cffec9c8f9377babacd1cb4490a278bace564b34861bf49b35258be7220c python-walletlibr-v is a wallet-lookalike PyPI package that ships no wallet functionality — only a stub hello that prints 'Hello from my custom...

Malicious code in python-walletlibr-v (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6783cffec9c8f9377babacd1cb4490a278bace564b34861bf49b35258be7220c python-walletlibr-v is a wallet-lookalike PyPI package that ships no wallet functionality — only a stub hello that prints 'Hello from my custom...

Malicious code in @immuta/pxl-components (npm)

Malicious package due to data exfiltration, arbitrary command execution, and suspicious install scripts targeting dependency confusion. Source: amazon-inspector 03d86f67d7f931d0f720838a4bda33d56a54a5502b29ebe3e1094a984041b7a2 The package @immuta/pxl-components was found to contain malicious code...

CVE-2026-78685

Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page...

Qinglong-Combo-Exploit

🐉 Qinglong Combo Exploit Qinglong Panel Three Vulnerabili...

CVE-2026-78685 Le-yan｜Medical Practice Management System - Remote Code Execution

Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page...

CVE-2026-78685

CVE-2026-78685 affects the Le-yan Medical Practice Management System , a web-based application for managing medical practices. The vulnerability is a Remote Code Execution (RCE) flaw that allows unauthenticated remote attackers to execute arbitrary OS commands by serving a crafted HTML page that ...

EUVD-2026-65217

The Grav Email plugin getgrav/grav-plugin-email before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publi...

CVE-2026-75574

CVE-2026-75574 is a remote code execution vulnerability in the Grav Email plugin (getgrav/grav-plugin-email) versions before 4.2.2 . The root cause is that page-editor-controlled Email action parameters are rendered as unsandboxed Twig templates . An authenticated remote user possessing only api....

CVE-2026-80138: Improper Neutralization of Special Elements used in an OS Command

ClipBucket V5's web installer fails to properly validate or escape the phpclifilepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious phpclifilepath value to execute arbitrary commands as the web server...

RHEL 8 : sg3_utils (RHSA-2026:59555)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59555 advisory. The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes:...

PT-2026-81159

Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page...

RHEL 8 : sg3_utils (RHSA-2026:59567)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59567 advisory. The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes:...

PT-2026-81350

Name of the Vulnerable Software and Affected Versions mcp-shell versions prior to 0.6.0 Description The software contains two security flaws that allow unrestricted operating system command execution. First, the security configuration is disabled by default when the MCP SHELL SEC CONFIG FILE...

RHEL 9 : sg3_utils (RHSA-2026:59397)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59397 advisory. The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes:...

RHEL 8 : sg3_utils (RHSA-2026:59568)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59568 advisory. The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes:...

MSC-2026-11441

Twenty-four purpose-built npm packages ship a single HTML file as their package payload rather than any JavaScript, and are published solely so that CDN mirrors of the registry serve the file as a fake browser-verification page from a trusted domain. Installing the packages executes nothing; the...

PT-2026-81146

The Grav Email plugin getgrav/grav-plugin-email before 4.2.2 renders page-editor-controlled Email action parameters as unsandboxed Twig templates. An authenticated remote user with only api.access and api.pages.write permissions can place a Twig expression in header.form.process.email.body, publi...

PT-2026-94328

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.7 Description NodeVM fails to normalize node:-prefixed builtin specifiers when evaluating negative deny entries in a wildcard require policy. While the node: prefix is stripped during resolution, negative wildcard...