Malicious Package

Overview @mailpoet/eslint-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

EUVD-2026-4189

Malicious code in @mailpoet/eslint-config npm...

Malicious code in @mailpoet/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c16934b5188a78db664e2c22b5fbfd7b089e580072216391bbf8925261484d0 The package @mailpoet/eslint-config was found to contain malicious code. Source: ghsa-malware...

MAL-2026-456 Malicious code in @mailpoet/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c16934b5188a78db664e2c22b5fbfd7b089e580072216391bbf8925261484d0 The package @mailpoet/eslint-config was found to contain malicious code. Source: ghsa-malware...

aiomisc-pytest (1.2.1), bayesnestor (0.1.8) +23 more potentially affected by CVE-2025-71176 via pytest (8.2.0)

pytest PYPI version 8.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - aiomisc-pytest 1.2.1 - bayesnestor 0.1.8 - camel-oasis =0.0.1, =0.1.21, =2.0.0.1, =4.3.0, =0.1.0, =0.1.0, =0.9.0b13, =0.2.0, =0.1.0, =0.3.3 and more...

CVE-2025-27378

AES contains a SQL injection vulnerability due to an inactive configuration that prevents the latest SQL parsing logic from being applied. When this configuration is not enabled, crafted input may be improperly handled, allowing attackers to inject and execute arbitrary SQL queries...

Azure Linux 3.0 Security Update: kernel (CVE-2025-23161)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-23161 advisory. - In the Linux kernel, the following vulnerability has been resolved: PCI: vmd: Make vmddev::cfglock a...

Azure Linux 3.0 Security Update: kernel (CVE-2024-42085)

"The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-42085 advisory. - In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: core: remove lock of otg mod...

PT-2026-3957

EduSoho versions prior to 22.4.7 contain an arbitrary file read vulnerability in the classroom-course-statistics export functionality. A remote, unauthenticated attacker can supply crafted path traversal sequences in the fileNames parameter to read arbitrary files from the server filesystem,...

Azure Linux 3.0 Security Update: kernel (CVE-2025-38131)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-38131 advisory. - In the Linux kernel, the following vulnerability has been resolved: coresight: prevent deactivate active...

PT-2026-3947

A path traversal vulnerability exists in TMS Management Console version 6.3.7.27386.20250818 from TMS Global Software. The "Download Template" function in the profile dashboard does not neutralize directory traversal sequences ../ in the filePath parameter, allowing authenticated users to read...

Prettier eslint-config-prettier Embedded Malicious Code Vulnerability

Prettier eslint-config-prettier contains an embedded malicious code vulnerability. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via improper validation of OIDC token claims after processing through CEL expressions. An attacker can gain unauthorized operator-level read access and perform actions such as suspend, resume, or reconcile by...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via improper validation of OIDC token claims after processing through CEL expressions. An attacker can gain unauthorized operator-level read access and perform actions such as suspend, resume, or reconcile by...

CVE-2021-47802

CVE-2021-47802 affects Tenda D151 and D301 routers. The issue is an unauthenticated configuration download vulnerability reachable via /goform/getimage, permitting remote attackers to retrieve router configuration data, including admin credentials. The provided connected sources corroborate the v...

Missing Authorization

Overview org.apache.solr:solr-core is an open source enterprise search platform built on Apache Lucene Affected versions of this package are vulnerable to Missing Authorization in the Rule Based Authorization Plugin, by which the getPermissionName function can be forced to return null. An attacke...

CVE-2025-58089

Multiple reflected cross-site scripting xss vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This...

CVE-2025-58095

Multiple reflected cross-site scripting xss vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This...

CVE-2025-58087

Multiple reflected cross-site scripting xss vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This...

CVE-2025-58093

Multiple reflected cross-site scripting xss vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This...