CVE-2026-26333 Calero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCE

Calero VeraSMART versions prior to 2022 R1 expose an unauthenticated .NET Remoting HTTP service on TCP port 8001. The service publishes default ObjectURIs including EndeavorServer.rem and RemoteFileReceiver.rem and permits the use of SOAP and binary formatters with TypeFilterLevel set to Full. An...

MAL-2026-879 Malicious code in codexworld (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector adbcf3a15ca44fb393a6c8e40217d59fb72f228be073dda7d50c70236131d586 The package codexworld was found to contain malicious code. Source: ghsa-malware f062939a6f9a6652f3a2e08c3192935b45ce6fd84970a96e43007d424e25b573 Any...

MAL-2026-883 Malicious code in ecosystem_ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4987a955f090814c8e125cdaca051b7d106fc4e853cc4e45bc253fbb444f8d94 The package ecosystemui was found to contain malicious code. Source: ghsa-malware 31a22a7e3ce76544adef6885be748f17910483d02a1f19395a520b918516ea63 An...

Malicious code in responses-starter-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83a4aedeb600114d998f8a0351978f589d1d3e9d55ebe061e7d25e95db19d2c7 The package responses-starter-app was found to contain malicious code. Source: ghsa-malware...

MAL-2026-892 Malicious code in wropz-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48a8b0a5b3f12323a6bbc3014fa023b370236b8874253a47ed61930d4bbcee4d The package wropz-module was found to contain malicious code. Source: ghsa-malware fbe5a4f55692f6a9db6c052776dc2fcfd3825f7da077f3e45b67466cd4059bd0 A...

Malicious code in metadata-stripper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8c267045a16bae6cd73d8221edda625cfc4c3492849b92a48065fd3cbb2723a The package metadata-stripper was found to contain malicious code. Source: ghsa-malware...

MAL-2026-893 Malicious code in xsstesting (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f21a18d9a86ac4934f1f0b7970e4530834a2fedfa1c2c3abbd3e2d3e3c664f9 The package xsstesting was found to contain malicious code. Source: ghsa-malware f0cd84b068f1b6a6bf2ac129128c0e052ca218788bc569eedce535a479333fc4 Any...

MAL-2026-880 Malicious code in console-style-pro0o0o0o (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fe7407a5523ef7efe6bec615d9601fe978b9e5de59d19d7e8e2ff054c5e09e9 The package console-style-pro0o0o0o was found to contain malicious code. Source: ghsa-malware...

The vulnerability of the service layer of the Cisco Intersight Virtual Appliance software allows a hacker to gain full control over the device.

The vulnerability of the service layer of the Cisco Intersight Virtual Appliance software management system for cloud systems is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability can allow an attacker to gain full control over the device...

CVE-2019-25344

Wondershare MobileGo 8.5.0 contains an insecure file permissions vulnerability that allows local users to modify executable files in the application directory. Attackers can replace the original MobileGo.exe with a malicious executable to create a new user account and add it to the Administrators...

CVE-2026-26218

newbee-mall includes pre-seeded administrator accounts in its database initialization script. These accounts are provisioned with a predictable default password. Deployments that initialize or reset the database using the provided schema and fail to change the default administrative credentials m...

CVE-2026-21722

A flaw was found in Grafana. Public dashboards with annotations enabled fail to limit their annotation time range to the locked time range of the public dashboard. This flaw allows an attacker to retrieve the entire history of annotations visible on that dashboard, including those outside the...

PYSEC-2026-33

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec. The import builtin was included in the allowed builtins, allowing unauthenticated remote...

CVE-2026-1104

The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to unauthorized backup creation and download due to a missing capability check on REST API endpoints in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with...

CVE-2026-1104

CVE-2026-1104 affects the FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress. The vulnerability is due to a missing capability check on REST API endpoints across all versions up to and including 2.7.1, enabling authenticated attackers with Contributor-level access and above t...

CVE-2026-1104

The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to unauthorized backup creation and download due to a missing capability check on REST API endpoints in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with...

CVE-2026-1104 FastDup – Fastest WordPress Migration & Duplicator <= 2.7.1 - Missing Authorization to Authenticated (Contributor+) Backup Creation and Download

The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to unauthorized backup creation and download due to a missing capability check on REST API endpoints in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with...

PT-2026-7851

The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to unauthorized backup creation and download due to a missing capability check on REST API endpoints in all versions up to, and including, 2.7.1. This makes it possible for authenticated attackers, with...

CVE-2026-2248

METIS WIC devices versions = oscore 2.1.234-r18 expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root UID 0 privileges. This results in full system compromis...

Malicious code in chai-prop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6708dacd87e4aafa4ffafa5b20fff5ae416d6580ba01ddcaaa51ca08f0317c85 The package chai-prop was found to contain malicious code. Source: ghsa-malware 46a6572ddbd6c8ceef059f6e07126d160a849cf4912b1befe7b4523393c72484 Any...