CVE-2026-25711 Chargemap chargemap.com Insufficient Session Expiration

The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent...

CVE-2026-20036

A vulnerability in the CLI and web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker with valid administrative privileges to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to...

CVE-2026-20107

A vulnerability in the Object Model CLI component of Cisco Application Policy Infrastructure Controller APIC could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. To exploit this vulnerability, the attacker...

CVE-2026-28211 Arbitrary code execution in log reader via untrusted log file

The NVDA Dev & Test Toolbox is an NVDA add-on for gathering tools to help NVDA development and testing. A vulnerability exists in versions 2.0 through 8.0 in the Log Reader feature of this add-on. A maliciously crafted log file can lead to arbitrary code execution when a user reads it with log...

MAL-2026-1052 Malicious code in foundry-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3762da1ba2c85b0e0210a98196cefcf7914ab00712944886cb47409656409ac6 The package foundry-toolkit was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in foundry-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3762da1ba2c85b0e0210a98196cefcf7914ab00712944886cb47409656409ac6 The package foundry-toolkit was found to contain malicious code. Source: ossf-package-analysis...

Aeternum C2 Botnet Stores Encrypted Commands on Polygon Blockchain to Evade Takedown

Cybersecurity researchers have disclosed details of a new botnet loader called Aeternum C2 that uses a blockchain-based command-and-control C2 infrastructure to make it resilient to takedown efforts. "Instead of relying on traditional servers or domains for command-and-control, Aeternum stores it...

Malicious code in windowston (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a6a92aff7b9a6be04f3050f1895e2d53e77dd8c9eba110c970ab59c7d003d81 The package windowston was found to contain malicious code. Source: ghsa-malware 87bbab5dffef9e8b05cc36129ad2ac67f2c980f4b85ee393b0f23ee8fa15fd85 Any...

MAL-2026-1057 Malicious code in windowston (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a6a92aff7b9a6be04f3050f1895e2d53e77dd8c9eba110c970ab59c7d003d81 The package windowston was found to contain malicious code. Source: ghsa-malware 87bbab5dffef9e8b05cc36129ad2ac67f2c980f4b85ee393b0f23ee8fa15fd85 Any...

CVE-2026-28296 Gvfs: ftp gvfs backend: arbitrary ftp command injection via crlf sequences in file paths

A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing carriage return and line feed CRLF sequences. These unsanitized sequences allow the attacker to terminate intended FTP commands and...

Malicious code in jslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11f2fdea43a54f2aac247e06fcc46c506979a5b1ccb5d178077662e61f747b74 The package jslint-config was found to contain malicious code. Source: ghsa-malware bddd0b74c730da3b118b7ef92befbc93b4b1379cc23ce7535e843151a84ae957...

MAL-2026-1055 Malicious code in jslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11f2fdea43a54f2aac247e06fcc46c506979a5b1ccb5d178077662e61f747b74 The package jslint-config was found to contain malicious code. Source: ghsa-malware bddd0b74c730da3b118b7ef92befbc93b4b1379cc23ce7535e843151a84ae957...

Malicious code in zoddle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b21aded7bb690c93924ac4c0458ab189fbe6e878112364281ff687473453a5e0 The package zoddle was found to contain malicious code. Source: ghsa-malware 966916af3c9fb77f02c18f21ab03d721694167ce47d97754503ef7dc604a844d Any...

MAL-2026-1058 Malicious code in zoddle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b21aded7bb690c93924ac4c0458ab189fbe6e878112364281ff687473453a5e0 The package zoddle was found to contain malicious code. Source: ghsa-malware 966916af3c9fb77f02c18f21ab03d721694167ce47d97754503ef7dc604a844d Any...

MAL-2026-1051 Malicious code in corstoken (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0d343f604565676254c8b24e997c84396038593cf5259c15d044ec3c5ab3350 The package corstoken was found to contain malicious code. Source: ghsa-malware d7d7cc0fd416fdcbdfe3517bbfd1ffec7e67ce88349fb17ddd2b22e408f740ed Any...

CLSA-2026-1772103023 Fix CVE(s): CVE-2025-15367

SECURITY UPDATE: newline-based command injection in user-controlled commands - debian/patches/CVE-2025-15367.patch: Reject control characters in protocol commands; prevent acceptance and processing of control characters as cause of malformed commands. - CVE-2025-15367...

Malicious code in iosysredis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40ebc0b0ce3b008449dfcb8149458898f7bbbffbac1a58a1ac3f5e002585b45c The package iosysredis was found to contain malicious code. Source: ghsa-malware 0d8b923c8adb27e2f28e5804af5428885fe3b1399d1cead59dd5a505e3c6f586 Any...

MAL-2026-1054 Malicious code in iosysredis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40ebc0b0ce3b008449dfcb8149458898f7bbbffbac1a58a1ac3f5e002585b45c The package iosysredis was found to contain malicious code. Source: ghsa-malware 0d8b923c8adb27e2f28e5804af5428885fe3b1399d1cead59dd5a505e3c6f586 Any...

Malicious code in undicy-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e5df89180b140f5106db0b74f5ee04330236214094173880f7baf0fd47088a8 The package undicy-lint was found to contain malicious code. Source: ghsa-malware 2713794393ff885438b3aa1cc6dc97cff34cd42825c28e917bf8ec24ee704ff7 An...

MAL-2026-1056 Malicious code in undicy-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e5df89180b140f5106db0b74f5ee04330236214094173880f7baf0fd47088a8 The package undicy-lint was found to contain malicious code. Source: ghsa-malware 2713794393ff885438b3aa1cc6dc97cff34cd42825c28e917bf8ec24ee704ff7 An...