Malicious code in zoddle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b21aded7bb690c93924ac4c0458ab189fbe6e878112364281ff687473453a5e0 The package zoddle was found to contain malicious code. Source: ghsa-malware 966916af3c9fb77f02c18f21ab03d721694167ce47d97754503ef7dc604a844d Any...

MAL-2026-1058 Malicious code in zoddle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b21aded7bb690c93924ac4c0458ab189fbe6e878112364281ff687473453a5e0 The package zoddle was found to contain malicious code. Source: ghsa-malware 966916af3c9fb77f02c18f21ab03d721694167ce47d97754503ef7dc604a844d Any...

MAL-2026-1051 Malicious code in corstoken (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0d343f604565676254c8b24e997c84396038593cf5259c15d044ec3c5ab3350 The package corstoken was found to contain malicious code. Source: ghsa-malware d7d7cc0fd416fdcbdfe3517bbfd1ffec7e67ce88349fb17ddd2b22e408f740ed Any...

CLSA-2026-1772103023 Fix CVE(s): CVE-2025-15367

SECURITY UPDATE: newline-based command injection in user-controlled commands - debian/patches/CVE-2025-15367.patch: Reject control characters in protocol commands; prevent acceptance and processing of control characters as cause of malformed commands. - CVE-2025-15367...

Malicious code in iosysredis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40ebc0b0ce3b008449dfcb8149458898f7bbbffbac1a58a1ac3f5e002585b45c The package iosysredis was found to contain malicious code. Source: ghsa-malware 0d8b923c8adb27e2f28e5804af5428885fe3b1399d1cead59dd5a505e3c6f586 Any...

MAL-2026-1054 Malicious code in iosysredis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40ebc0b0ce3b008449dfcb8149458898f7bbbffbac1a58a1ac3f5e002585b45c The package iosysredis was found to contain malicious code. Source: ghsa-malware 0d8b923c8adb27e2f28e5804af5428885fe3b1399d1cead59dd5a505e3c6f586 Any...

Malicious code in undicy-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e5df89180b140f5106db0b74f5ee04330236214094173880f7baf0fd47088a8 The package undicy-lint was found to contain malicious code. Source: ghsa-malware 2713794393ff885438b3aa1cc6dc97cff34cd42825c28e917bf8ec24ee704ff7 An...

MAL-2026-1056 Malicious code in undicy-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e5df89180b140f5106db0b74f5ee04330236214094173880f7baf0fd47088a8 The package undicy-lint was found to contain malicious code. Source: ghsa-malware 2713794393ff885438b3aa1cc6dc97cff34cd42825c28e917bf8ec24ee704ff7 An...

CVE-2026-1929

The Advanced Woo Labels plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.37. This is due to the use of calluserfuncarray with user-controlled callback and parameters in the getselectoptionvalues AJAX handler without an allowlist of permitted...

CLSA-2026-1772098033 python2: Fix of CVE-2025-15367

CVE-2025-15367: reject control characters in POP3 commands to prevent command injection via embedded newlines...

CVE-2026-27969

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location e.g. an S3 bucket can manipulate backup manifest files so that files in the manifest — which may be files that they have also...

AZL-78516 CVE-2026-27969 affecting package vitess 17.0.7-14

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location e.g. an S3 bucket can manipulate backup manifest files so that files in the manifest — which may be files that they have also...

PT-2026-22232

Name of the Vulnerable Software and Affected Versions EV2GO affected versions not specified Description The software’s WebSocket endpoints do not have sufficient authentication, allowing attackers to impersonate charging stations without authorization and manipulate data transmitted to the backen...

PT-2026-22231

Name of the Vulnerable Software and Affected Versions Systems utilizing WebSocket endpoints for Open Charge Point Protocol OCPP communication affected versions not specified Description WebSocket endpoints are missing appropriate authentication, allowing attackers to impersonate charging stations...

CVE-2026-27577

n8n is an open source workflow automation platform. Prior to versions 2.10.1, 2.9.3, and 1.123.22, additional exploits in the expression evaluation of n8n have been identified and patched following CVE-2025-68613. An authenticated user with permission to create or modify workflows could abuse...

Malicious code in promanage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34866a6d91e495c7692a123d4f1b31f1a98cf793744c4649f92eccf97d43ee9b The package promanage was found to contain malicious code. Source: ghsa-malware 55e3f919d2876892f9e686ad04eb2e38c1f5fdb1e3d93f39fc306563d9a4fa18 Any...

MAL-2026-1038 Malicious code in promanage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34866a6d91e495c7692a123d4f1b31f1a98cf793744c4649f92eccf97d43ee9b The package promanage was found to contain malicious code. Source: ghsa-malware 55e3f919d2876892f9e686ad04eb2e38c1f5fdb1e3d93f39fc306563d9a4fa18 Any...

CVE-2025-33179

NVIDIA Cumulus Linux and NVOS products contain a vulnerability in the NVUE interface, where a low-privileged user could run an unauthorized command. A successful exploit of this vulnerability might lead to escalation of privileges...

MAL-2026-1043 Malicious code in uuindex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a373d8c2c653d1b6effee8ff65bba442fcf08d7eea88ec95707680697385646 The package uuindex was found to contain malicious code. Source: ghsa-malware 47c06a7b235c91fbc08cc942c69f1e05ecdb8093c9658bd5ade2b8866cc33f4c Any...

Improper Encoding or Escaping of Output

Overview Magick.NET-Q16-HDRI-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...