CVE-2026-102096

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary...

CVE-2026-102096 Kiteworks Core OS command injection

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary...

CVE-2026-102096 Kiteworks Core OS command injection

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary...

EUVD-2026-90379

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary...

CVE-2026-102096

Kiteworks Core versions prior to 9.5.0 are vulnerable to an OS Command Injection flaw. The vulnerability exists because the system fails to sufficiently validate the contents of a configuration package uploaded by an authenticated administrator. A crafted package can trigger the execution of arbi...

CVE-2026-102096: Improper Neutralization of Special Elements used in an OS Command

Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configuration package whose contents were not sufficiently validated before being processed. A crafted package could cause the underlying system to execute arbitrary...

Malicious code in @ornikar/commitlint-config (npm)

npm/@ornikar/commitlint-config is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

RHEL 8 : pcs (RHSA-2026:8093)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:8093 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: tornado-python: Tornado: Denia...

Malicious Package

Overview @rexorg/config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2025-113539

Malicious code in forever-proxima-node-config-leda npm...

EUVD-2025-115796

Malicious code in callback-request-server-node-config npm...

EUVD-2025-121982

Malicious code in sirius-config-npm-restart npm...

Malicious code in @zalastax/nolb-eslint-config-g (npm)

The package @zalastax/nolb-eslint-config-g was found to contain malicious code...

Malicious code in @zalastax/nolb-eslint-config-n (npm)

The package @zalastax/nolb-eslint-config-n was found to contain malicious code...

MAL-2025-9099 Malicious code in @marketing-tech/eslint-config (npm)

The package @marketing-tech/eslint-config was found to contain malicious code...

MAL-2025-7944 Malicious code in @frozen-team/eslint-config-qa (npm)

The package @frozen-team/eslint-config-qa was found to contain malicious code...

Malicious code in @fhnw/angular-app-configuration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 48cd6f8295f6741b9e52645ffbbb0792c303dc53b7371dbd456a13ea90d952a5 The OpenSSF Package Analysis project identified '@fhnw/angular-app-configuration' @ 1.0.4 npm as malicious. It is considered malicious because: ...

Malicious code in localization-configuration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 825c642696ea5f30780f48b909d4ab3e393a8e64c037249e775b138a1d2ac838 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

I/O Trace Tool Buffer Overflow RCE

The vulnerability of the I/O Trace Tool formerly NI-Spy detection and analysis utility in the System Configuration package is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow a attacker to execute arbitrary code using a specially...

CVE-2021-22646 Ovarro TBox Code Injection

The “ipk” package containing the configuration created by TWinSoft can be uploaded, extracted, and executed in Ovarro TBox, allowing malicious code execution...