Malicious code in autbank-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c4077e84d7c02b7a8259ade848e89f9fd07ba0db7fb06bbaaa0c6e75f3e007d On npm install, preinstall.js enumerates process.env for keys matching credential substrings KEY, SECRET, TOKEN, PASSWORD, AWS, API, CREDENTIAL, AUTH...

CVE-2026-17349

A flaw was found in pgAdmin 4. An authenticated, low-privilege user could exploit a vulnerability in the adhoc server cloning feature to gain unauthorized access to another user's stored database credentials. By initiating an adhoc connection to a shared server owned by another user, the cloning...

CVE-2026-68457

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for FSCTL mutations SETSPARSE, SETZERODATA and SETCOMPRESSION operate on an open SMB handle but call VFS xattr, fallocate or fileattr helpers with the current ksmbd worker credentials. Those helpers...

UBUNTU-CVE-2026-68457

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for FSCTL mutations SETSPARSE, SETZERODATA and SETCOMPRESSION operate on an open SMB handle but call VFS xattr, fallocate or fileattr helpers with the current ksmbd worker credentials. Those helpers...

EUVD-2026-59079

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for FSCTL mutations SETSPARSE, SETZERODATA and SETCOMPRESSION operate on an open SMB handle but call VFS xattr, fallocate or fileattr helpers with the current ksmbd worker credentials. Those helpers...

CVE-2026-68457 ksmbd: use opener credentials for FSCTL mutations

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for FSCTL mutations SETSPARSE, SETZERODATA and SETCOMPRESSION operate on an open SMB handle but call VFS xattr, fallocate or fileattr helpers with the current ksmbd worker credentials. Those helpers...

MAL-2026-14096 Malicious code in svelte-goal-vim (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ad94557dcf8609bd1dbec00633fa3850e30f977d894850f983cf127bb05c1ca The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

PT-2026-72169

In the Linux kernel, the following vulnerability has been resolved: ksmbd: use opener credentials for FSCTL mutations SET SPARSE, SET ZERO DATA and SET COMPRESSION operate on an open SMB handle but call VFS xattr, fallocate or fileattr helpers with the current ksmbd worker credentials. Those...

Linux Distros Unpatched Vulnerability : CVE-2026-68457

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ksmbd: use opener credentials for FSCTL mutations SETSPARSE, SETZERODATA and SETCOMPRESSION operate on an open SMB handle but call VFS xattr, fallocate or...

Malicious code in bcs-mini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e476c27d0fcb2d394107a3fa8131c7b278152340ef508f1a13658e19cbbed5 bcs-mini presents itself as a BCS codec but contains an install/require-time payload in index.js that steals Sui wallet material. On module load, a...

MAL-2026-14047 Malicious code in @guangnao/agent-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8da2cb00fa6d2b5a0e5f4a4bdca8ca0cfaedf7e583b0f9e9f54274bcf5c39e06 On invocation of agent-proxy start, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint hub.client-llm.com, reconstructed...

CVE-2026-19631

A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive data, including credentials...

EUVD-2026-58733

A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive data, including credentials...

CVE-2026-19631 SQL Injection

A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive data, including credentials...

CVE-2026-19631

CVE-2026-19631 describes a SQL injection vulnerability in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries and access sensitive data, including credentials. Tenable’s advisory indicates Security Center 6.9.0 fixes multiple vulnerabilities and lists ...

EUVD-2026-58716

Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. This has bee...

CVE-2026-53472

A flaw was found in migration-planner. Insufficient validation of the AgentStatusUpdate.CredentialUrl field allows an authenticated attacker to store a malicious javascript: URL. When a victim views this URL in the Hybrid Cloud Console, it can lead to Cross-Site Scripting XSS, enabling script...

CVE-2025-71405

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

UBUNTU-CVE-2025-71405

chi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft...

CVE-2025-71405

The CVE-2025-71405 entry concerns the chi library prior to v5.2.2. The vulnerability lies in the RedirectSlashes middleware, which uses the Host header to build redirect URLs. An attacker can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing and credential theft. ...