MAL-2026-539 Malicious code in n8n-nodes-gg-udhasudsh-hgjkhg-official (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f177f9d8bad0a259983bc9f3e0880c59ee120b1e686e3f10b490ab0527beec3 The package n8n-nodes-gg-udhasudsh-hgjkhg-official was found to contain malicious code. Source: ghsa-malware...

Malicious code in n8n-nodes-gasdhgfuy-rejerw-ytjsadx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e080478bd45e69f6daa0a8af616a71d7c1461853f41a3820e574459d96a7294a The package n8n-nodes-gasdhgfuy-rejerw-ytjsadx was found to contain malicious code. Source: ghsa-malware...

MAL-2026-538 Malicious code in n8n-nodes-gasdhgfuy-rejerw-ytjsadx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e080478bd45e69f6daa0a8af616a71d7c1461853f41a3820e574459d96a7294a The package n8n-nodes-gasdhgfuy-rejerw-ytjsadx was found to contain malicious code. Source: ghsa-malware...

Malicious code in fileupload-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cfeee070d9e37cd2dda0d7557f93098e1589be17d77ff38abf265f564574ca3 The package fileupload-core was found to contain malicious code. Source: ghsa-malware aa58dfc19074922a9db4713e1aa1c17edc8de5a937d01a5c08271d4940bcc38...

PT-2026-4880

Name of the Vulnerable Software and Affected Versions EZCast Pro II version 1.17478.146 Description A Cross-Site Request Forgery exists in the Admin UI. This allows attackers to bypass authorization checks and gain full access to the admin UI. Recommendations Update to a newer version that contai...

EZCast Pro II security vulnerabilities

EZCast Pro II is a computer screen-sharing software developed by EZCast Corporation in China. This software allows for wireless sharing of data from computer devices onto televisions or projection screens. EZCast Pro supports screen allocation and projection permissions. Version 1.17478.146 of...

The vulnerability of the Core component in Oracle VM VirtualBox allows a hacker to gain full control over the application.

The vulnerability of the Core component in Oracle VM VirtualBox is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain full control over the application...

CVE-2026-24477

CVE-2026-24477 affects AnythingLLM (prior to 1.10.0) when configured with Qdrant as the vector database. The root cause is exposure of the QdrantApiKey in plain text through the /api/setup-complete endpoint, enabling an unauthenticated attacker to gain full read/write access to the Qdrant vector ...

EUVD-2026-4681

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the administrator account password. By sending a crafted request directly to the backend endpoint, an...

CVE-2026-24139

MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below do not safeguard against authorization bypass, allowing guest users to download the complete application database. The application fails to properly validate user permissions on the database export...

BIT-MOODLE-2025-3640 Moodle: idor in web service allows users enrolled in a course to access some details of other users

A flaw was found in Moodle. Insufficient capability checks made it possible for a user enrolled in a course to access some details, such as the full name and profile image URL, of other users they did not have permission to access...

EUVD-2025-206378

The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilities it is possible to directly execute commands...

CVE-2025-59102 Secrets Stored in Plaintext in Database in dormakaba access manager

The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database contains the whole configuration. This includes encrypted MIFARE keys, card data, user PINs and much more. The PINs are even stored unencrypted. Combined with...

CVE-2025-59097

The CVE-2025-59097 issue affects the dormakaba exos 9300 configuration GUI used to push configurations to Access Managers (e.g., 92xx, 9230, 9290). When the user saves a configuration, the SOAP payload is sent to the selected Access Manager without authentication or authorization by default. Whil...

Exploit for CVE-2026-24061

CVE-2026-24061 Scanner: GNU Inetutils Telnet Exploit Checker...

Malicious code in ostk-otel-autoconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b222e0d41ae144cf784f7fd2c40bd0c9bcb213c76581f4f9285f6f5d3baf36a The package ostk-otel-autoconfig was found to contain malicious code. Source: ghsa-malware...

[SECURITY] Fedora 43 Update: python3.9-3.9.25-3.fc43

Python 3.9 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.9, see other distributions that support it, such as CentOS or RHEL or older Fedo...

[SECURITY] Fedora 42 Update: python3.9-3.9.25-3.fc42

Python 3.9 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.9, see other distributions that support it, such as CentOS or RHEL or older Fedo...

CVE-2026-24139

MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below do not safeguard against authorization bypass, allowing guest users to download the complete application database. The application fails to properly validate user permissions on the database export...

CVE-2026-24139

MyTube is a self-hosted downloader and player for several video websites. Versions 1.7.78 and below do not safeguard against authorization bypass, allowing guest users to download the complete application database. The application fails to properly validate user permissions on the database export...