Eval Injection

Overview Affected versions of this package are vulnerable to Eval Injection via unsanitized YAML parameters in the cluster import endpoint /v3/import/tokenclusterId.yaml. An attacker can execute arbitrary commands on the server by supplying crafted input to the endpoint, potentially breaking out ...

Apple patches Beats Studio Buds flaw that could turn earbuds into a wiretap

Apple has patched a Bluetooth flaw in Beats Studio Buds that could potentially turn your earbuds into a nearby wiretap. When you buy a pair of Bluetooth earbuds, you expect them to play your music and your calls—not someone else’s. But a vulnerability in Apple’s Beats Studio Buds shows how that...

CVE-2026-12010

A flaw was found in Google Chrome. This vulnerability, a heap buffer overflow in the Graphics Processing Unit GPU, could allow a remote attacker to escape the sandbox. To exploit this, the attacker would first need to compromise the renderer process and then trick a user into opening a specially...

MAL-2026-6205 Malicious code in ts-esys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 041ff0fd2b76f380705ef23061ebfe469477b2fbec8e025eab49a557431a551e The package is published as ts-esys but its package.json author, repository URL, funding metadata, and README are copied verbatim from MikeMcl/big.js...

MAL-2026-6204 Malicious code in ts-ecro-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86149b041033a917b3b743b9381a14368e79015385b27b89429cf7f6a35d0d30 No suspicious behaviors were identified in this package version. There are no lifecycle hook hazards, no outbound network calls to attacker-controlle...

Malicious code in ts-esys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 041ff0fd2b76f380705ef23061ebfe469477b2fbec8e025eab49a557431a551e The package is published as ts-esys but its package.json author, repository URL, funding metadata, and README are copied verbatim from MikeMcl/big.js...

Malicious code in assert-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e21fa9c37e9944a00f7e85c7476f8fd4dc6bcd1f8fcd064a90488ef93d5bd12 [email protected] impersonates the chai assertion library bundles chai's source, contributors, and API surface under a different author and homepage...

MAL-2026-6201 Malicious code in eth-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fcfa5a90c6e60f1e3a94db0277e5d9bd0058d0d5d3a549e3e62dfb6e05f4223 Package eth-util impersonates the legitimate @ethereumjs/util package: README, repository URL github.com/ethereumjs/ethereumjs-monorepo, badges,...

CVE-2026-12049

A flaw was found in pgAdmin 4. This open redirect vulnerability exists in the multi-factor authentication MFA flow. An authenticated user could be tricked into clicking a specially crafted link, which would redirect them to an attacker-controlled website. This could increase the success rate of...

dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure

A flaw was found in .NET Framework. This protection mechanism failure allows an unauthorized attacker to execute arbitrary code locally. Successful exploitation of this vulnerability can lead to a complete compromise of the affected system...

Security Bulletin: MySQL 0-day exploit (CVE-2016-6662)

Question Security Bulletin: MySQL 0-day exploit CVE-2016-6662 "Business Unit":"code":"BU059","label":"IBM Software w/o TPS","Product":"code":"SS8NDZ","label":"IBM Aspera","Component":"","Platform":"code":"PF025","label":"Platform Independent","Version":"All Versions","Edition":"","Line of...

Malicious code in parket-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31d62a38af75a45a91e590e0cffe4f58e900fe726b4323af1e481118d146277c index.js imports childprocess and invokes execSync with bash and zsh shells lines 315 and 331. Without traced reachability, it is not established...

Pipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID

Development Runner Telephony WebSocket /ws Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID Summary The pipecat development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without any authentication. An unauthenticated remote attacker who...

Dynamics 365 Elevation of Privilege Vulnerability

Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network...

Docker MCP Gateway: Argument injection via OCI image label YAML

Summary A maliciously crafted OCI image label can inject arbitrary arguments into the docker run command line constructed by the MCP Gateway. An attacker who controls an image that the victim references via docker://, or that the victim's catalog pulls a snapshot from, can mount the host...

CVE-2026-10023

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.0.3 via the changeorderstatus, addordernote, deleteordernote,...

MAL-2026-6094 Malicious code in metrics-probe-f256 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fdf2b93d50f09ea1b087bdc33578fedec5483e75c7a9acd61355cc02f9f7ec0 Package declares a postinstall lifecycle hook "postinstall": "node run.js" in package.json that executes run.js automatically on npm install. run.js...

MAL-2026-6114 Malicious code in metrics-probe-88ad (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55133df30aa5d5678607d6f0a32d8b292c4fdf876893978a6785209304434fe6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6101 Malicious code in type-check-816d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bd3f7912317a2b9465a4c22ea948951f70aaa8c0d12f152572d43febc5667dd The package declares a postinstall hook "postinstall": "node run.js" that runs run.js automatically on npm install. run.js imports os, https, http, a...

MAL-2026-6115 Malicious code in npm-sandbox-research-a1b2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd030068356281ae499fe6af7fd86ae10cac9f77f2f3fcc4d2d9abb67750be19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...