Malicious code in desmos-graphing-vxtbz5de (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba9e06cf661b8e6c80f1e5f5303f8ce9537a9cf909f5110848364a0565a2aae3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15460 Malicious code in secure-test-browser-yp88o07w (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fcdde9a08c190c554d2681d2eb758290d0c6f58d3cb7b4504cb1c9502d893fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15463 Malicious code in secure-test-browser-z2j7z8ae (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f63bad7d6413d1737998c772e15d947abb65965d5def33c308c02c93b241462 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Microsoft Edge (Chromium-based) Spoofing Vulnerability

External control of file name or path in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

PT-2026-83262

Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description External control of a file name or path allows an unauthorized attacker to perform spoofing over a network. Recommendations At the moment, there is no information about ...

CVE-2026-66324: External Control of File Name or Path

External control of file name or path in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

MAL-2026-14577 Malicious code in hydration-ui-dlx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e76afa004355ba53a89056c6daff511bb4f41e2bd666e2a5592d033e079e5740 The package's main module contains a top-level IIFE that chmods 0o755 and detached-spawns dist/internal/math-calc.mjs, which is a Linux x8664 ELF...

CVE-2026-59683: External Control of File Name or Path

The OpenRGB network protocol allows to write attacker controlled strings into arbitrary file system paths extension of CVE-2026-59682. This allows either a full system compromise from local or remote if the daemon is running as root or a full account takeover if the daemon is running in user...

Security Bulletin: Vulnerability in Keras affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in Keras has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerability...

External Control of Assumed-Immutable Web Parameter

Overview Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter through WebsocketConstants and the AtmosphereWebsocketEndpointBuilderFactory/WebsocketProducer dispatch headers in the atmosphere-websocket producer. An attacker can redirect or suppre...

CVE-2026-76158

Datiphy Data Management Center (v8.3.0 through v8.5.1) contains a path traversal vulnerability in its upload API endpoint. An unauthenticated remote attacker can supply relative or absolute path sequences to write files to arbitrary locations outside the intended upload directory, enabling arbitr...

CVE-2026-76158 Datiphy Data Management Center - External Control of File Name or Path

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences...

CVE-2026-54134: External Control of File Name or Path

OctoPrint provides a web interface for controlling consumer 3D printers. Prior to 1.11.8 and 2.0.0rc3, OctoPrint's custom Tornado upload handler and Flask with Werkzeug parse request parameters differently, allowing an attacker with FILEUPLOAD permission to inject reserved internal upload fields...

CVE-2026-76158: External Control of File Name or Path

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences...

CVE-2025-36398

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to read or modify another user's command history due to an externally controlled filename...

CVE-2026-20358 Cisco Crosswork Security Hardening Release: August 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-20358 Cisco Crosswork Security Hardening Release: August 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The...

CVE-2026-49441: External Control of File Name or Path

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the non-merged branch of processfilesfromworker in framework/wazuh/core/cluster/master.py trusts a peer-controlled filepath key from filesmetadata.json. The...

PT-2026-76966

Name of the Vulnerable Software and Affected Versions Citrix WorkSpace App version 2607 Description An issue exists in Citrix WorkSpace App on MacOS that allows external control of a file name or path. This occurs when the application does not properly validate the file path provided by an extern...

CVE-2026-18751: External Control of File Name or Path

External control of file name or path vulnerability in Citrix WorkSpace App on MacOS. This issue affects WorkSpace App: 2607...