Malicious code in devplatform-react-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21349fd06b973a43dd3b8e7bbf1ec9c726d71fba81e1656410d718a3ef4b7e7e [email protected] is a dropper disguised as a React MCP SDK. On require, index.js loads helpers.js which assembles three Cloudflare Worker...

MAL-2026-13515 Malicious code in eacq-dialog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af2bcb4382f02a977f8448ea4f0172253035755b2d1dc363cce80f0389a1ee70 [email protected] contains a dropper reachable both from setup.js and from the main-exported lib/telemetry.js loaded on require'eacq-dialog'. The co...

Malicious code in bigops-telephony-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccbd56ae20f9cc922c12df25456654a649c9bbc963aae4fa95e027f97628c45b Requiring the package index.js -./setup triggers setup.js, which reconstructs destination hostnames from split string fragments e.g...

MAL-2026-13494 Malicious code in bigops-telephony-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccbd56ae20f9cc922c12df25456654a649c9bbc963aae4fa95e027f97628c45b Requiring the package index.js -./setup triggers setup.js, which reconstructs destination hostnames from split string fragments e.g...

pip absolute path traversal during download from malicious package indexes

...

MAL-2026-13486 Malicious code in fastapii (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf67e733322de0ce3d08269697e6ccd9460233319cadd5f97f05c8d1e855665a fastapii 0.1.2 is a single-character typosquat of the popular fastapi package. Its setup.py registers a custom setuptools install cmdclass LinuxInsta...

PT-2026-69042

Name of the Vulnerable Software and Affected Versions SEBLOD versions prior to 3.30.0 SEBLOD versions prior to 4.7.0 SEBLOD versions prior to 6.0.1 Description An unauthenticated attacker can perform a path traversal attack to download files located both inside and outside the webroot. Path...

CVE-2026-54200: External Control of File Name or Path

Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a local file inclusion vulnerability in the send email, fax, SMS, etc. functionality. By specifying an '@@attach' command in the form field 'scjob', files can be attached to a message, which can then be downloaded by an authenticated user....

CVE-2026-66914: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD 3.30.0, 4.7.0, 6.0.1 - An unauthenticated attacker could download files from both inside and outside the webroot...

PT-2026-69149

Name of the Vulnerable Software and Affected Versions HKUDS nanobot versions prior to 0.3.1 Description An issue exists in the Provider-returned Image URL Handler component within the download image data url function of the nanobot/providers/image generation.py file. This flaw allows a remote...

Malicious code in weight2loss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8b80ee1c23ef1ae185bbda67deab7b442f673434427f2c006acb4e7f388a52e The package ships setup.js, referenced by a postinstall hook in package.json, that on execution: 1 reads installer-side secrets from /.npmrc, /.ssh/,...

CVE-2026-70558

Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new Filepath and file.transferTodest with no path validation. The route is marked @SaIgnore and /download/ is excluded from the Sa-Token interceptor, so the only guard is a header equality che...

Contao: Possible path traversal in job download URIs

Summary An authenticated backend user who can access one job can request an attachment identifier containing ../ segments and make the job attachment download endpoint read a file from another job directory inside var/job-attachments. The controller authorizes only the jobUuid route parameter. Th...

CVE-2026-70558 Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token

Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new Filepath and file.transferTodest with no path validation. The route is marked @SaIgnore and /download/ is excluded from the Sa-Token interceptor, so the only guard is a header equality che...

CVE-2026-70558 Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token

Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new Filepath and file.transferTodest with no path validation. The route is marked @SaIgnore and /download/ is excluded from the Sa-Token interceptor, so the only guard is a header equality che...

CVE-2026-70558

Dinky CVE-2026-70558 affects the v1.2.5 release and development branch. The vulnerable component is the POST /download/uploadFromRsByLocal handler, which passes a caller-supplied path directly to new File(path) and file.transferTo(dest) with no path validation. The route is SaIgnore’d and /downlo...

CVE-2026-28146

Contributor Arbitrary File Download in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.14 versions...

CVE-2026-28146

CVE-2026-28146 is about an Arbitrary File Download vulnerability in the WordPress plugin Unlimited Elements For Elementor (Free Widgets, Addons, Templates) , affecting versions up to and including 2.0.14. The connected reports identify the affected product and vulnerability type but do not provid...

CVE-2026-28146 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability

Contributor Arbitrary File Download in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.14 versions...

CVE-2026-28146 WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.14 - Arbitrary File Download vulnerability

Contributor Arbitrary File Download in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.14 versions...