PT-2026-25612

Name of the Vulnerable Software and Affected Versions OpenLiteSpeed and LSWS Enterprise versions affected versions not specified Description OpenLiteSpeed and LSWS Enterprise provided by LiteSpeed Technologies contain an OS command injection issue. An attacker with administrative privileges can...

TP-LINK多款产品 安全漏洞

TP-LINK TL-WR802N, etc., are products of the TP-LINK company from China. The TP-LINK TL-WR802N is a wireless router. The TP-LINK TL-WR840N is also a wireless router. The TP-LINK TL-WR841N is another product of TP-LINK. Several TP-LINK products have security vulnerabilities; these vulnerabilities...

OESA-2026-1558 libssh security update

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, transfer files, use a secure and transparent tunnel for your remote...

Malicious code in n8n-nodes-text-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d9e6f076079fc1e5969f32f2e96bf4ee653d57d47b342f378cc857e678051df The package n8n-nodes-text-helpers was found to contain malicious code. Source: ghsa-malware...

Malicious code in tracking-service-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbea868891563a569959fb4cb0283257c07da112b0e854b53431157e0a12af57 The package tracking-service-config was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in test_pkg_forppe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb7a0a95274f0d2d68d1bf6fc49d05bfc1b8a7e041147c0597e8db59c5552015 The package testpkgforppe was found to contain malicious code. Source: ghsa-malware 4f40eeeea0e63ed3d90dbfcf8f947f134cf561db8c1775a61ae4099c71c926e4...

MAL-2026-1423 Malicious code in test_pkg_forppe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb7a0a95274f0d2d68d1bf6fc49d05bfc1b8a7e041147c0597e8db59c5552015 The package testpkgforppe was found to contain malicious code. Source: ghsa-malware 4f40eeeea0e63ed3d90dbfcf8f947f134cf561db8c1775a61ae4099c71c926e4...

Malicious code in native_dep (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf8cbbcc5fef314cdaa3a8b8c2d15e298a0c5f1c444084cc36a8dc36a95b7da1 The package nativedep was found to contain malicious code. Source: ghsa-malware 96b85414b77cb51face1caae1f5ab5ab4ba386fb95ba1c8594ac3ce47a6cb19d Any...

CVE-2026-32628

AnythingLLM has a SQL injection in the built‑in SQL Agent plugin (v1.11.1 and earlier) allowing a user who can invoke the agent to run arbitrary SQL on connected databases. The vulnerability stems from getTableSchemaSql() building queries via direct string concatenation of the table_name paramete...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization through the configWrites authorization. An attacker can modify protected configuration data of sibling accounts by issuing channel commands that target accounts with...

GHSA-8JHH-JCQG-MJ5P OpenClaw: Channel commands could bypass account-scoped `configWrites` restrictions

Summary In affected versions of openclaw, channel-initiated config mutations were authorized against the originating account's configWrites policy but did not consistently re-check the targeted account scope. An authorized sender on one account could mutate protected sibling-account configuration...

OpenClaw: Channel commands could bypass account-scoped `configWrites` restrictions

Summary In affected versions of openclaw, channel-initiated config mutations were authorized against the originating account's configWrites policy but did not consistently re-check the targeted account scope. An authorized sender on one account could mutate protected sibling-account configuration...

GHSA-XF99-J42Q-5W5P OpenClaw: Unbound interpreter and runtime commands could bypass node-host approval integrity

Summary In affected versions of openclaw, node-host system.run approvals could still execute rewritten local code for interpreter and runtime commands when OpenClaw could not bind exactly one concrete local file operand during approval planning. Impact Deployments using node-host system.run...

Malicious code in cw-isdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae10c11f397ea01855bd467e8a77fc7f7ccb97477c54bfee0bae46cd5c324ca4 The package cw-isdk was found to contain malicious code. Source: ghsa-malware 54e686b27022344685c371190035a9586a04498a711c2456bdd9b5644c43c833 Any...

MAL-2026-1420 Malicious code in cw-isdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae10c11f397ea01855bd467e8a77fc7f7ccb97477c54bfee0bae46cd5c324ca4 The package cw-isdk was found to contain malicious code. Source: ghsa-malware 54e686b27022344685c371190035a9586a04498a711c2456bdd9b5644c43c833 Any...

CVE-2026-4105

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus Desktop Bus method. A local unprivileged user can exploit this by attempting to register a machine with a...

CVE-2026-4105

CVE-2026-4105 affects the systemd project, specifically the systemd-machined service. The vulnerability arises from improper access control in the RegisterMachine D-Bus method, due to insufficient validation of the class parameter. A local, unprivileged user can attempt to register a machine with...

MAL-2026-1456 Malicious code in rrweb-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2c1a8d89ba0817d9264bc9f6e59c5c1e4c683b98ce32ba7d9bcb3e61f1f016b The package rrweb-v1 was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in rrweb-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2c1a8d89ba0817d9264bc9f6e59c5c1e4c683b98ce32ba7d9bcb3e61f1f016b The package rrweb-v1 was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in @lux2/ssr-catalogue-sfcc (npm)

Package collects system info, exfiltrates data to a suspicious IP, executes shell commands, and uses pre/postinstall scripts. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b625e0932d70166d526fb8fa4993c8c448699203e795ad308cfe52cd784b28ff The package...