PT-2026-4278

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description The web application does not adequately validate inputs that should be constant but are subject to external control. A user with limited privileges can alter...

Malicious code in aligntype (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00d265590e58665b4942474738b7d5beca8f636eb79e8761f736088d603f9277 The package aligntype was found to contain malicious code. Source: ghsa-malware b0d41c223d47ebc018df2b4ee07cde5c197d028c7b973a32f34bcb4e19e9a7fd Any...

Malicious code in jsonwebauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 683ba88a9e72aab5f114bdd388e92a35230a3fcad8178b8c8d5e5e6fddf7b829 The package jsonwebauth was found to contain malicious code. Source: ghsa-malware c1c270e023225a3ab0872fa3ea9f9b94b0320639bdaa6fb0d30e9b65c9ba1db2 An...

Malicious code in manage-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ade61c26597c5b0a24785713d87a304ddf30ae13dd50c69ba89e653ec4c2729 The package manage-root was found to contain malicious code. Source: ghsa-malware 6b0fc8397f56e86ac97a5adedd2c89de19045dffbdabbf982ffcf5944449b178 An...

MAL-2026-402 Malicious code in vworldviewdir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0b210fefd46c64493bc3663c4af48a69cac8f12908d33018d20697bd2085c7c The package vworldviewdir was found to contain malicious code. Source: ghsa-malware 3dfab7849c9725e5a6853c4868c0e27a4013044ba3aa7602eb9fbb06bf714f62...

MAL-2026-403 Malicious code in worldnormal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 406eb16c91569acae88fa2f33de6107f6a758568c40b800908ac924d1a7e87fd The package worldnormal was found to contain malicious code. Source: ghsa-malware 1c9bf70b2f92f241477ec0cae21b7f094e1d4d1090cbb837bfd90fa9430f26ac An...

MAL-2026-383 Malicious code in @mikudev/ridwan-signal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c96124a8175a81f43ffbd0c2b9acc96782560b9e737266ccac47204d9605f31 The package @mikudev/ridwan-signal was found to contain malicious code. Source: ghsa-malware...

Malicious code in sezzle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 494df714262f72408f0837d726757cb6301b1b31166da85a96b278858857ed9a The package sezzle was found to contain malicious code. Source: ghsa-malware 6b28a829b2018ce361449e8c3b0ee03a5b51e6adc2383159bbf4f5421d5694a6 Any...

Malicious code in ofjaaah-auth-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 680db6543dbee7ec4f8cfe557fc5c76a13bb684b7faeec4e6e2582c0d89ecdf7 The package ofjaaah-auth-module was found to contain malicious code. Source: ghsa-malware...

BIT-KIBANA-2026-0532 External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector

External Control of File Name or Path CWE-73 combined with Server-Side Request Forgery CWE-918 can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticate...

BIT-ELK-2026-0532 External Control of File Name or Path and Server-Side Request Forgery (SSRF) in Kibana Google Gemini Connector

External Control of File Name or Path CWE-73 combined with Server-Side Request Forgery CWE-918 can allow an attacker to cause arbitrary file disclosure through a specially crafted credentials JSON payload in the Google Gemini connector configuration. This requires an attacker to have authenticate...

CVE-2026-20872

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-20931

External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network...

CVE-2026-20931

External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network...

CVE-2026-20872

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-20931

CVE-2026-20931 is a Windows Telephony Service elevation-of-privilege vulnerability described as external control of a file name or path. The connected sources confirm the affected component as Windows Telephony Service and the issue enables an attacker on an adjacent network to obtain increased p...

CVE-2026-20872

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

NTLM Hash Disclosure Spoofing Vulnerability

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

NTLM Hash Disclosure Spoofing Vulnerability

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

PT-2026-2730

CVE-2026-20925 External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. https://t.co/M2xjSW13S7...