Malicious code in argon-web3-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 608cea5b2c28269fa6aa53d4dcd211b83843a935732729e7ec08a2a2130d9209 The package argon-web3-chain was found to contain malicious code. Source: ghsa-malware 6680014069f64072ffb4e22ed7e3779a0b88e7c503644cb0a491d67605078c...

CVE-2025-14009

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The unzipiter function in nltk/downloader.py uses zipfile.extractall without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when...

CVE-2026-23647

Glory RBG-100 recycler systems using the ISPK-08 software component contain hard-coded operating system credentials that allow remote authentication to the underlying Linux system. Multiple local user accounts, including accounts with administrative privileges, were found to have fixed, embedded...

CVE-2026-23647

The CVE-2026-23647 advisory describes Glory RBG-100 recycler systems using the ISPK-08 software with hard-coded operating-system credentials embedded across multiple local accounts, including admin-privileged ones. An attacker with network access to exposed services (e.g., SSH) can authenticate u...

CVE-2026-23647 Glory RBG-100 Recycler System Hard-coded OS Credentials

Glory RBG-100 recycler systems using the ISPK-08 software component contain hard-coded operating system credentials that allow remote authentication to the underlying Linux system. Multiple local user accounts, including accounts with administrative privileges, were found to have fixed, embedded...

Malicious code in responses-starter-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83a4aedeb600114d998f8a0351978f589d1d3e9d55ebe061e7d25e95db19d2c7 The package responses-starter-app was found to contain malicious code. Source: ghsa-malware...

CVE-2019-25344

Wondershare MobileGo 8.5.0 contains an insecure file permissions vulnerability that allows local users to modify executable files in the application directory. Attackers can replace the original MobileGo.exe with a malicious executable to create a new user account and add it to the Administrators...

PT-2026-7597

METIS WIC devices versions = oscore 2.1.234-r18 expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root UID 0 privileges. This results in full system compromis...

Malicious code in json-mapping-sources (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77824e69a815d8ac27a50bb52fa0a39fe2c7e512e6597d3aefd500b0eae847e8 The package json-mapping-sources was found to contain malicious code. Source: ghsa-malware...

MAL-2026-799 Malicious code in @rsgweb/rockstar-account (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd40e663999d2780e2e131fd5da090045d623032e6c51db70d0bd65cf583101d The package @rsgweb/rockstar-account was found to contain malicious code. Source: ghsa-malware...

Malicious code in internallib_v157 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d07f4a0d2270cdcb827bb50e9f546d7c4ab3b07ede66343b90478831a731b83 The package internallibv157 was found to contain malicious code. Source: ghsa-malware 2a4eddb6af3191b7183a9223407a3a1b9fb4e1b4e96da5ee15af1ae2f0515ac...

MAL-2026-758 Malicious code in tailwindcss-forms-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91e47d3466ef7beca3f6d4cc16c77c91c52a3d29dbbe4d484fcf3e2397f18d2c The package tailwindcss-forms-starter was found to contain malicious code. Source: ghsa-malware...

Malicious code in express_update (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28c7b65df1b37b94c79306e3445abeee20ff9f0b8757efec76a2c3ae2a258e78 The package expressupdate was found to contain malicious code. Source: ghsa-malware e6705fb6bba3859557f5fcc5e759b38a88a71c878260762672e3e161afde2c0e...

MAL-2026-749 Malicious code in @purecore/rabbitmq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e503973dbf2c860017e4ea8118ddec5cd43a537c32eb8fca24ac544a86d8822 The package @purecore/rabbitmq was found to contain malicious code. Source: ghsa-malware...

PT-2026-6661

Name of the Vulnerable Software and Affected Versions FUXA versions through 1.2.9 Description An information disclosure issue in FUXA allows a remote, unauthenticated attacker to obtain sensitive administrative database credentials. Exploitation allows an attacker to access the full system...

Malicious code in @msecscc/gaia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35c005bdb108aca2e4bc9842086fa98dd73b442764e4e7814fd6e7a9fa7010dd The package @msecscc/gaia was found to contain malicious code. Source: ghsa-malware 5186ac1e518b181d1e03469aa042d8dddefbe3345b3c85d5b795ed329e5c3a73...

Gladinet CentreStack & Triofox - Hardcoded Credentials

Gladinet CentreStack and Triofox 16.12.10420.56791 contain a hardcoded credentials vulnerability caused by use of hardcoded AES cryptoscheme values, letting attackers perform arbitrary local file inclusion without authentication, potentially leading to full system compromise. id: CVE-2025-14611...

MAL-2026-714 Malicious code in reactt-sdkk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1040004e57d22b532a81d886c4a8d7847ea79a24950a31bc092da3f8ff0e46b The package reactt-sdkk was found to contain malicious code. Source: ghsa-malware 56b1676235be8d72d317cee06957d2c7c8b4a3e8fd215927e13b76fdcfe44384 An...

FUXA allows Remote Code Execution (RCE) via the project import functionality.

FUXA v1.2.7 allows Remote Code Execution RCE via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise...

Malicious code in @ikeacnalan/icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69aa8245ea172b28e43591f47b972fc5e5901c90a4154f6b5962f7a9a3a2e844 The package @ikeacnalan/icons was found to contain malicious code. Source: ghsa-malware...