amavis

Installation Use your system's amavis package if possible. Prerequisites Software dependencies are tracked via Dist::Zilla. Some of them involve non-perl development libraries and GCC as a build dependency if obtained from CPAN: libdb libidn2 libssl libzmq3 On Debian 13 for example, one can insta...

pdfjs-vuln-demo

PDF.js Vulnerability Demo Project This project is intended to serve as a proof of concept to demonstrate exploiting the vulnerability in the PDF.js pdfjs-dist library reported in CVE-2024-4367 Getting Things Running Fork and clone from this repository npm install npm run dev Testing Things Out...

pdfjs-vuln-demo

PDF.js Vulnerability Demo Project This project is intended to serve as a proof of concept to demonstrate exploiting the vulnerability in the PDF.js pdfjs-dist library reported in CVE-2024-4367 Getting Things Running Fork and clone from this repository npm install npm run dev Testing Things Out...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.1, <=3.4.2) potentially affected by CVE-2026-71896 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.1, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.1, =3.4.1, =3.4.2 Source cves: CVE-2026-71896 Source advisory: MEND:CVE-2026-71896...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.0, <=3.4.2) potentially affected by CVE-2026-71895 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.0, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.0, =3.4.0, =3.4.2 Source cves: CVE-2026-71895 Source advisory: MEND:CVE-2026-71895...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.0, <=3.4.2) potentially affected by CVE-2026-71183 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.0, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.0, =3.4.0, =3.4.2 Source cves: CVE-2026-71183 Source advisory: MEND:CVE-2026-71183...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.0, <=3.4.2) potentially affected by CVE-2026-66087 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.0, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.0, =3.4.0, =3.4.2 Source cves: CVE-2026-66087 Source advisory: MEND:CVE-2026-66087...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.0, <=3.4.2) potentially affected by CVE-2026-66084 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.0, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.0, =3.4.0, =3.4.2 Source cves: CVE-2026-66084 Source advisory: MEND:CVE-2026-66084...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.0, <=3.4.2) potentially affected by CVE-2026-66082 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.0, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.0, =3.4.0, =3.4.2 Source cves: CVE-2026-66082 Source advisory: MEND:CVE-2026-66082...

Malicious code in dotenv-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50639fcdb3317812a161b8f54fbf22d2565881af534da0d2ec8f7d37ecbd3f3b The package presents itself as a dotenv parser but on require index.cjs calls a function named dispatchAnalytics that reads dist/stest.jpg, extracts ...

MAL-2026-17657 Malicious code in dotenv-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50639fcdb3317812a161b8f54fbf22d2565881af534da0d2ec8f7d37ecbd3f3b The package presents itself as a dotenv parser but on require index.cjs calls a function named dispatchAnalytics that reads dist/stest.jpg, extracts ...

MAL-2026-17505 Malicious code in dotenv-promises (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 254f0bcbb8014fb07414eb0b41a898deac682aa8c8b7a8541a0f7538ac274f9a The package is published as 'dotenv-promises' but its bundled manifest declares the internal name '[email protected]' and mimics the dotenv API...

Malicious code in dotenv-promises (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 254f0bcbb8014fb07414eb0b41a898deac682aa8c8b7a8541a0f7538ac274f9a The package is published as 'dotenv-promises' but its bundled manifest declares the internal name '[email protected]' and mimics the dotenv API...

Malicious code in virgil-cli (npm)

In local mode virgil-cli prints that it runs on the user's machine and is free and private. After each turn, reportLearning in dist/api.js posts the whole conversation history, including shell and file tool output, to https://api.nm-streetwear.space/vx/learn with a hardcoded token and a device id...

MAL-2026-17630 Malicious code in virgil-cli (npm)

In local mode virgil-cli prints that it runs on the user's machine and is free and private. After each turn, reportLearning in dist/api.js posts the whole conversation history, including shell and file tool output, to https://api.nm-streetwear.space/vx/learn with a hardcoded token and a device id...

CVE-2026-104848 Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own...

Malicious code in cortana-md-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a2de4b6992a1dd7177803253b8c214d1ba7cc911cf0e1e7f800e1e9ff7ab5b1 cortana-md-engine is a Baileys-based WhatsApp bot whose bundled entrypoints dist/hosted.cjs and dist/index.cjs hardcode five...

MAL-2026-17323 Malicious code in cortana-md-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a2de4b6992a1dd7177803253b8c214d1ba7cc911cf0e1e7f800e1e9ff7ab5b1 cortana-md-engine is a Baileys-based WhatsApp bot whose bundled entrypoints dist/hosted.cjs and dist/index.cjs hardcode five...

MAL-2026-17305 Malicious code in esm-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55c5c67c48596e011158554f8b5ea57d65a8a8dc3b5f4120d3c9c4d1cf961da2 The package advertises itself as a zero-dependency dotenv parser but its main entry dist/index.cjs and CLI bin dist/cli.cjs both invoke...

Malicious code in testosu888 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3faa5787fbebe8c5d73f3291c77975efb91c504dddf6a1d82cbe7e9f25372b27 On loading dist/index.cjs main entry and on running the dot2env CLI dist/cli.cjs, the package invokes a dispatchAnalytics routine that reads...