MAL-2026-12221 Malicious code in tailwind-custom-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a94fe37df5952bc2326d9f0a759cf89d7105f47790fc71dc4731d87ec67a7f2 The package impersonates @tailwindcss/forms: package.json declares the name tailwind-custom-forms while the repository field points at...

Malicious code in tailwind-animationpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63abd5591507bb96b45cdf17209563ccfe52015a0bb8c5258bf3ea8cdc034fb3 src/index.js appends an obfuscated evalatob... block after a legitimate-looking Tailwind plugin export. The decoded loader hides module names and...

MAL-2026-12217 Malicious code in tailwind-animate-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eb20d422c7053793a78e3d898bef2d97269318be88f147d60c7d036d2d23144 index.js appends a large base64-encoded, unicode-escaped payload after 11 KB of whitespace padding, executed via evalatob'...' whenever the package i...

📄 OpenCATS Installer PHP Code Injection

This Metasploit module exploits an unauthenticated PHP code injection in the OpenCATS installer AJAX endpoint CVE-2026-27760. The databaseConnectivity action passes the user POST parameter directly to changeConfigSetting, which interpolates it into a define statement in config.php without any...

PT-2026-68151

Name of the Vulnerable Software and Affected Versions rust-iot-platform affected versions not specified Description An unauthenticated attacker can achieve arbitrary JavaScript execution in the server process by creating and triggering a malicious calc rule. The endpoint 'POST /calc-rule/create'...

Malicious code in webdev-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9577d9f40486af224c5dd365ffbab6a5d45c4a052dfe6de50bc1d8f130d9642a [email protected] is a typosquat of the sindresorhus/pkg-conf library, published under author 'Sinde Sorus' homoglyph of Sindre Sorhus. index.js...

CVE-2026-69264

Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...

Eval Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Eval Injection via the CSVAgent process. An attacker can execute arbitrary code on the host system by injecting malicious input into the csvFile parameter, which is interpolated directly into...

Eval Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Eval Injection via the CSVAgent process. An attacker can execute arbitrary code on the host system by injecting malicious input into the csvFile parameter, which is interpolated directly into a Python sourc...

CVE-2026-67195

Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval with only...

Eval Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Eval Injection through improper input validation in the baseURL parameter and insecure use of the vm2 sandbox. An attacker can execute arbitrary code on the server by injecting malicious JavaScript code via...

Eval Injection

Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Eval Injection through improper input validation in the baseURL parameter and insecure use of the vm2 sandbox. An attacker can execute arbitrary code on the server by injecting malicious...

CLSA-2026-1774830287 TuxCare security update for expr-eval (2 CVEs)

TuxCare rebuilt expr-eval to address 2 CVEs. Fixed in 2.0.2-tuxcare.1...

CVE-2026-67195 Perspective 5.0.0 RCE via eval() Expression Injection

Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval with only...

CVE-2026-67195

CVE-2026-67195 describes a remote code execution in Perspective 5.0.0 via an eval() expression injection in the PolarsVirtualServer backend. The vulnerability occurs when client-supplied input is passed directly to Python’s eval() with almost no sandboxing (builtins cleared). Attackers can traver...

EUVD-2026-52692

Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval with only...

CVE-2026-67195

Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval with only...

CVE-2026-67195 Perspective 5.0.0 RCE via eval() Expression Injection

Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied input directly to Python's eval with only...

CVE-2025-29296: Improper Neutralization of Special Elements used in a Command

H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NE36 Pro V100R002 and H3C MC102G HM1A0V200R010 contain multiple command injection vulnerabilities in the /api/esps request handler. The...

CVE-2025-29296

Several H3C network devices, including the Magic BE18000 V200R007 , NX400 V100R015 , Magic NX30 Pro V100R0011 , Magic R3010 V100R009 , Magic NX15 V100R017 , Magic R1510 V100R016 , NE36 Pro V100R002 , and MC102G HM1A0V200R010 , are vulnerable to multiple command injection flaws in the /api/esps re...