CVE-2026-11347

The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to dynamically generate Initialization Vectors IVs for AES/CBC encryption, making known-plaintext attacks feasible. An attacker with local access can...

CVE-2026-11347 Hardcoded Cryptographic Keys and Weak IV Generation in linqi

The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to dynamically generate Initialization Vectors IVs for AES/CBC encryption, making known-plaintext attacks feasible. An attacker with local access can...

CVE-2026-11347 Hardcoded Cryptographic Keys and Weak IV Generation in linqi

The linqi application contains hardcoded cryptographic keys. Additionally, the application uses a weak algorithm with a limited ASCII charset to dynamically generate Initialization Vectors IVs for AES/CBC encryption, making known-plaintext attacks feasible. An attacker with local access can...

Kwetsbaarheid verholpen in Cisco SD-WAN Manager

Cisco has identified a vulnerability in SD-WAN Manager, previously known as SD-WAN vManage. A malicious individual could exploit this vulnerability by uploading a specially crafted file to the affected system and thereby elevating their privileges to root user status. Cisco indicates that active...

BIT-MLFLOW-2026-4035 Environment Variable Resolution Vulnerability in mlflow/mlflow

A vulnerability in mlflow/mlflow versions prior to 3.11.0 allows for the resolution of environment variables in AI Gateway secrets, which can be exploited to exfiltrate sensitive server-side environment credentials to an attacker-controlled endpoint. This issue arises because the apikey field in...

CVE-2026-4035

A flaw was found in MLflow. This vulnerability allows an attacker to exfiltrate sensitive server-side environment credentials. It occurs because the AI Gateway secrets can resolve environment variables, which are then sent to an attacker-controlled endpoint. This could lead to unauthorized access...

BIT-SOLR-2026-44825 Apache Solr: Enabling BasicAuth using bin/solr CLI configures additional insecure users

Hardcoded credentials in the Basic Authentication setup tool bin/solr auth enable in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specifi...

Malicious code in awaitly-mongo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f476f15bad689e2500c24cf2f416567759e5182689cc2cc301912ddfde02b1c4 No concrete installer-harm signals were identified in this package version. The package name suggests a MongoDB-related async helper, but no specific...

Malicious code in effect-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05b6ba1ec02dea0ff73e03c34e3fc37cf4982f156578e03e50909b4d1c8ccc47 The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security...

Malicious code in autotel-playwright (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ac3753f5000aa2bef53314f8715b374c6996fd76c7646430af91f2549974118 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in wrangler-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d2085fa4916157b99799df085aa11e3d29bdb9a47f5798c85375b1bfdf8bd7e Package name wrangler-deploy is close to Cloudflare's official wrangler CLI, which raises confusion-risk concerns for developers who may install it...

Malicious code in node-env-resolver-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebb20ec41cd318dc4b8958df0ddc5c86e5fede7c4ee3c7ced1439aad3e943b97 The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security...

Malicious code in autotel-cloudflare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d324ad75e592bc93a8dc377ed5dd767a51a006b12141d0b4f33c95738b85a09 No concrete indicators of installer-side harm were identified for [email protected]. No lifecycle scripts fetching remote code, no...

Malicious code in autotel-backends (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5791740e97cb185ebd5c0e59c386020857b44a67a8c890c3826e19c60e11c3b4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5262 Malicious code in node-env-resolver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 760048287047e989e9525d9cbf2647fd2fb0807a274bfbd0b6ae77ed75cbce0f The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security...

MAL-2026-5239 Malicious code in awaitly-visualizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7f392622f2aeb9a1cd98719278777d45ea44442e6f3979175ed8d8b6f8a0389 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @ethlete/types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8f99e5213b116197421a47e5d43675c1772592479e5646e6683f28ca5e77873 The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security...

Malicious code in awaitly-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3f926748b1e107755cfd17cb9151edc730b0228b6e857735a6794f8c1e71c65 No concrete indicators of installer-side harm were identified in this package version. No lifecycle hooks fetching remote payloads, no credential-pat...

Malicious code in @forjacms/analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44f7217965dcd60b165d3303ec44e2fbd7419e287110e70011a1434d7b5870e0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security...

MAL-2026-5197 Malicious code in @ethlete/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08b825409803ac686945a28eef89851a6be7fb0a36433e564859f37a7edc17f9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security...