294860 matches found
CVE-2026-71274
OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...
Security update for pcp
This update for pcp fixes the following issues: CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. CVE-2026-16527: missing authenticatio...
CVE-2026-16022
@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync. A user-controlled project-name argument is inserted into the shell command without proper...
Security update for pcp
This update for pcp fixes the following issues: CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. CVE-2026-16527: missing authenticatio...
Malicious code in helixbox-connect (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45774464be73a3ba586a4eb9af5a89b3f2439a4f49a80c0b69eb4668cfcf7f89 The helixbox-connect bin opens a WebSocket to the hardcoded relay wss://helixbox-relay.onrender.com and dispatches messages from the peer into local...
MAL-2026-12793 Malicious code in helixbox-connect (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45774464be73a3ba586a4eb9af5a89b3f2439a4f49a80c0b69eb4668cfcf7f89 The helixbox-connect bin opens a WebSocket to the hardcoded relay wss://helixbox-relay.onrender.com and dispatches messages from the peer into local...
Security update for pcp
This update for pcp fixes the following issues: CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. CVE-2026-16527: missing authenticatio...
Security update for pcp
This update for pcp fixes the following issues: CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. CVE-2026-16527: missing authenticatio...
Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
Summary Multiple vulnerabilities were addressed in IBM Observability with Instana OnPrem build 1.0.321 Vulnerability Details CVEID:CVE-2026-48815 DESCRIPTION: sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in...
MAL-2026-12798 Malicious code in npm-groat (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eda7da760041a49d296b9a6e8cfa90ec4b7e5daecebbf50c88d41f7fd559a1b1 [email protected] declares a postinstall script that executes dist/config.js on npm install. That script performs an outbound fetch to...
Malicious code in npm-groat (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eda7da760041a49d296b9a6e8cfa90ec4b7e5daecebbf50c88d41f7fd559a1b1 [email protected] declares a postinstall script that executes dist/config.js on npm install. That script performs an outbound fetch to...
Malicious code in umber-root (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a16b80d2c76699beaf0773da7233c1e136a951a8edd0ba84b073ea78590c23e1 The npm postinstall lifecycle hook runs dist/config.js, which fetches JSON from https://my-api.trade-api.workers.dev?id=3 and then invokes...
MAL-2026-12814 Malicious code in umber-root (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a16b80d2c76699beaf0773da7233c1e136a951a8edd0ba84b073ea78590c23e1 The npm postinstall lifecycle hook runs dist/config.js, which fetches JSON from https://my-api.trade-api.workers.dev?id=3 and then invokes...
Malicious code in anthropic-setup (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a5019e390fffd163e88f49fe1fc12c4ce8d2e50d7563cf7cf0a38508dc4eef5 The package presents itself as an Anthropic API setup helper but writes /.claude/settings.json with ANTHROPICBASEURL set to...
MAL-2026-12510 Malicious code in anthropic-setup (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a5019e390fffd163e88f49fe1fc12c4ce8d2e50d7563cf7cf0a38508dc4eef5 The package presents itself as an Anthropic API setup helper but writes /.claude/settings.json with ANTHROPICBASEURL set to...
MAL-2026-12397 Malicious code in luluking (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b88d4d8ec638e21c3b126dc9416ed8e2f3781bb1cc1d8ebe5a6579d698c6082 On npm install, the package's postinstall hook runs index.js, which reconstructs a URL and shell command from String.fromCharCode numeric arrays,...
Malicious code in luluking (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b88d4d8ec638e21c3b126dc9416ed8e2f3781bb1cc1d8ebe5a6579d698c6082 On npm install, the package's postinstall hook runs index.js, which reconstructs a URL and shell command from String.fromCharCode numeric arrays,...
Malicious code in rollup-plugins-polyfills-rode (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09fa29e5d68238ff42feaba875bbfe1dbeed5214478a811e504bbed05bf7797d [email protected] is a typosquat of rollup-plugin-polyfill-node whose repository URL it copies verbatim into its own package.json...
MAL-2026-12430 Malicious code in rollup-plugins-polyfills-rode (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09fa29e5d68238ff42feaba875bbfe1dbeed5214478a811e504bbed05bf7797d [email protected] is a typosquat of rollup-plugin-polyfill-node whose repository URL it copies verbatim into its own package.json...
Malicious code in luluking3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a95cec14b778c5a61008305c1a4ee8155f777dbe02b6ae5cff25748584105ee On npm install, the package's postinstall hook runs index.js, which reconstructs a URL and shell command from String.fromCharCode char-code arrays...