MAL-2026-1036 Malicious code in uitil (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ff0b75197d8e7cd361d61461260811fba8920c54b8538cb5f21ec2fc1c885ec3 The package implements an undocumented way to execute code hidden in image files, and a function that searches for images in the current directory and attempts...

CVE-2021-47836 Markdown Explorer 0.1.1 - Persistent Cross-Site Scripting

Markdown Explorer 0.1.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through file uploads and editor inputs. Attackers can upload markdown files with embedded JavaScript payloads that execute in the application's privileged renderer context, allowin...

CVE-2021-47836

Markdown Explorer 0.1.1 is affected by a persistent cross-site scripting (XSS) vulnerability that allows attackers to upload Markdown files with embedded JavaScript to execute remote commands and potentially gain system access. Root cause is XSS via file uploads/editor inputs. Public exploits are...

CVE-2021-47836

Markdown Explorer 0.1.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through file uploads and editor inputs. Attackers can upload markdown files with embedded JavaScript payloads that execute in the application's privileged renderer context, allowin...

Malicious code in admin10001 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc13d446931a724bb83502dcd6a100131d103739a7f43eccb645e74db533433c The package admin10001 was found to contain malicious code. Source: ghsa-malware cd2649bb4fa68be63a9cdca6eb598a2c9b756cdfbbf050c3fa915074bccb1e1d Any...

MAL-2026-322 Malicious code in admin10001 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc13d446931a724bb83502dcd6a100131d103739a7f43eccb645e74db533433c The package admin10001 was found to contain malicious code. Source: ghsa-malware cd2649bb4fa68be63a9cdca6eb598a2c9b756cdfbbf050c3fa915074bccb1e1d Any...

CVE-2026-20759

OS Command Injection vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation, which may allow a logged-in user with the low"monitoring user" or higher privilege to execute an arbitrary OS command...

CVE-2026-20759

OS Command Injection vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation, which may allow a logged-in user with the low"monitoring user" or higher privilege to execute an arbitrary OS command...

MiracleLinux 7 : nautilus-3.22.3-4.el7 (AXSA:2018-2543:01)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-2543:01 advisory. An untrusted .desktop file with executable permission set could choose its displayed name and icon, and execute commands without warning when opened by the...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-001346)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-001346 advisory. A flaw was found in the Linux kernel netfilter implementation in versions prior to 5.5-rc7. A user with root CAPSYSADMIN access is able to panic the system when...

MiracleLinux 7 : emacs-24.3-20.el7 (AXSA:2017-2282:02)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-2282:02 advisory. A command injection flaw within the Emacs enriched mode handling has been discovered. By tricking an unsuspecting user into opening a specially crafted file...

MiracleLinux 3 : libvirt-0.8.2-29.0.1.AXS3 (AXSA:2013-46:01)

The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2013-46:01 advisory. Libvirt is a C toolkit to interact with the virtualization capabilities of recent versions of Linux and other OSes. Security issues fixed with this release:...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004171)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004171 advisory. A flaw was found in the Linux kernel netfilter implementation in versions prior to 5.5-rc7. A user with root CAPSYSADMIN access is able to panic the system when...

Thecus N4800Eco Nas Server Control Panel: Operating System Command Injection Vulnerability

The Thecus N4800Eco Nas Server Control Panel is a NAS control panel developed by Thecus Corporation. The Thecus N4800Eco Nas Server Control Panel has a vulnerability related to operating system command injection. This vulnerability stems from commands executed by user-defined endpoints, which may...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004612)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004612 advisory. A flaw was found in the Linux kernel netfilter implementation in versions prior to 5.5-rc7. A user with root CAPSYSADMIN access is able to panic the system when...

MiracleLinux 4 : qemu-kvm-0.12.1.2-2.415.AXS4.14 (AXSA:2014-502:05)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2014-502:05 advisory. Description : KVM for Kernel-based Virtual Machine is a full virtualization solution for Linux on x86 hardware. Using KVM, one can run multiple virtu...

CVE-2026-22708

Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain shell built-ins can still be executed without appearing in the allowlist and without requiring user approval. This allows an attacker via...

CVE-2025-62193

Sites running NOAA PMEL Live Access Server LAS are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of...

CVE-2025-62193 NOAA PMEL Live Access Server (LAS) PyFerret command injection

Sites running NOAA PMEL Live Access Server LAS are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of...

EUVD-2026-2723

Sites running NOAA PMEL Live Access Server LAS are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands. Fixed in a version of...