dts-data__damn-vulnerable-web-server

Damn Vulnerable Web Server Vulnerable Web Server written in...

pt-platform__DVWA

DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Applicati...

MAL-2026-13713 Malicious code in @sqlite-labs/createsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 375677417b15f83a0823aaf14899d5d55c2ae1f69820980fb68d618919ae1a75 The package's main entry index.js fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket...

Malicious code in @sqlite-labs/createsql (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 375677417b15f83a0823aaf14899d5d55c2ae1f69820980fb68d618919ae1a75 The package's main entry index.js fetches JavaScript from a hardcoded URL on a Vercel blob storage bucket...

JLSEC-2026-1242 ncurses v6.5 and v6.4 are vulnerable to Buffer Overflow in progs/infocmp.c, function...

The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow in analyzestring in progs/infocmp.c...

CVE-2026-72885

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, dockerContextPath accepted by apps/dokploy/components/dashboard/application/build/show.tsx flows through getDockerContextPath in packages/server/src/utils/filesystem/directory.ts into the unquoted cd command in...

CVE-2026-72902

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts...

CVE-2026-72884

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, sanitizeCommand in packages/server/src/utils/builders/compose.ts only trims whitespace and strips surrounding quotes from compose.command before exportEnvCommand and docker command interpolation, allowing an...

CVE-2026-72877

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker in packages/server/src/utils/providers/docker.ts and is validated only as an optional string. An authenticated user with...

CVE-2026-72879

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.8, the getRegistryCommands function in packages/server/src/utils/cluster/upload.ts interpolates registry.password and registry.registryUrl directly into a shell command without escaping. An authenticated user with project...

CVE-2026-72881

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, database backup and restore command builders in packages/server/src/utils/backups/utils.ts and packages/server/src/utils/restore/utils.ts interpolate database names, usernames, and passwords into nested shell command...

CVE-2026-72874

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, cloneGitRepository in packages/server/src/utils/providers/git.ts interpolates customGitUrl and customGitBranch into a git clone command passed to execAsync or execAsyncRemote, allowing an authenticated user with...

CVE-2026-71966

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands...

Malicious code in plp-contract (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e3ef373acec23f98bde23ab356fd83a31773db1aa9a01ec2505775893e990fb No install-time, import-time, or runtime code paths were identified that read installer secrets, fetch or execute remote code, relay caller data to...

MAL-2026-13711 Malicious code in plp-contract (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e3ef373acec23f98bde23ab356fd83a31773db1aa9a01ec2505775893e990fb No install-time, import-time, or runtime code paths were identified that read installer secrets, fetch or execute remote code, relay caller data to...

Malicious code in neutrl-contracts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b41aff3f07d1c63f5b9c6096798ce5ce7cb3b06028f1bc6361e9501c966742a0 Review of neutrl-contracts 2.0.2 on PyPI did not surface any code paths that exfiltrate installer data, execute attacker-controlled payloads at insta...

MAL-2026-13709 Malicious code in neutrl-contracts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b41aff3f07d1c63f5b9c6096798ce5ce7cb3b06028f1bc6361e9501c966742a0 Review of neutrl-contracts 2.0.2 on PyPI did not surface any code paths that exfiltrate installer data, execute attacker-controlled payloads at insta...

Malicious code in neutrl-core (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a9fd4e018ce439288641c2bb6098fcfab811252142bcff5280e2b842aade9f providers.py in neutrl-core 2.0.2 contains a covert routine named handleanalytics that, when a JSON-RPC response includes cfg == 'collect', scrapes...

MAL-2026-13710 Malicious code in neutrl-core (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a9fd4e018ce439288641c2bb6098fcfab811252142bcff5280e2b842aade9f providers.py in neutrl-core 2.0.2 contains a covert routine named handleanalytics that, when a JSON-RPC response includes cfg == 'collect', scrapes...

CVE-2026-72902

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.13, Dokploy allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById in apps/dokploy/server/api/routers/registry.ts...