10187 matches found
MAL-2026-14270 Malicious code in nodealpha (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423876c4051bc91d09f39b56a198d2dfead5c9a7d7e169337e32edfd1035e31e The package installs a global keyboard hook keyboard.addhotkey on ctrl+c, polls the system clipboard every 300ms via pyperclip.paste, and captures...
Malicious code in nodeberlin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0daee18c4afae327b271a2178e90822f750a17d97f7dfb1236e6dd37ef9410d9 The CLI polls the system clipboard every 300ms and captures full-desktop or user-snipped screen regions, then POSTs the JSON text and base64-encoded...
MAL-2026-14271 Malicious code in nodeberlin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0daee18c4afae327b271a2178e90822f750a17d97f7dfb1236e6dd37ef9410d9 The CLI polls the system clipboard every 300ms and captures full-desktop or user-snipped screen regions, then POSTs the JSON text and base64-encoded...
Malicious code in ambera (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d24544221570c21c3b710d7c4d39ed76e7cc8b43a555bb7c8e6fefa78aa3f625 The package presents itself as a zero-dependency SVG helper, but its exported getPlugin function performs an HTTPS GET to the hardcoded host...
Malicious code in tailwind-custom-templates (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d351d7ff50f3580218e7a19a2686d8576ee000868a762d6ccb854e272b892720 The package advertises itself as a Tailwind form-styling plugin and bundles a verbatim copy of tailwindcss-forms into src/index.js, but appends an...
Malicious code in tfjs-inference (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52ebb387c7f1f9bb3e96df6f8006cabc9141ddd1da35a58bfc14b42f2f6864eb The package name typosquats TensorFlow.js and its npm postinstall lifecycle script collects installer host identifiers hostname, platform, arch,...
PT-2026-78730
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Splunk Secure Gateway versions prior to 3.10.10 Splunk Secure Gateway...
PT-2026-78819
🚨 CVE-2026-76392 In Splunk AI Toolkit versions below 6.0.0, a user who does not hold the "admin" or "power" Splunk roles could obtain predictable or default credentials for connected container services. The use of hard-coded credentials is possible because Splunk AI Toolkit generates or stores...
MAL-2026-14136 Malicious code in agora402-payment-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f The package advertises itself as a payment utility library, but its public API validateRecipient, routePayment, processPayment discards the...
Malicious code in agora402-payment-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f The package advertises itself as a payment utility library, but its public API validateRecipient, routePayment, processPayment discards the...
CVE-2021-43717
An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector equipped with an iProjection function, you can access the projector using hard-coded authentication information and control the projector maliciously...
GO-2026-6232 Assisted Migration Agent: Hardcoded insecure Transport Layer Security (TLS) connections during vCenter communication in github.com/kubev2v/assisted-migration-agent
Assisted Migration Agent: Hardcoded insecure Transport Layer Security TLS connections during vCenter communication in github.com/kubev2v/assisted-migration-agent...
ANT-2026-6FH6D5TF · supabase/supabase · other
other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-6FH6D5TF: Hardcoded Realtime tenant-credential encryption key with no override In docker/docker-compose.yml the...
CVE-2026-23933
In Zabbix 7.4 , a cryptographic key used for signing Frontend sessions was erroneously written to the database seed. This vulnerability specifically impacts deployments utilizing both SAML authentication and guest users , where the key can be used to forge valid session cookies, potentially leadi...
CVE-2026-23933 Hardcoded session key in Zabbix 7.4
In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid...
CVE-2026-23933 Hardcoded session key in Zabbix 7.4
In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid...
EUVD-2021-34864
An issue exists in pson EH-TW5350 Epson iProjection.apk v3.2.6. If you identify a projector equipped with an iProjection function, you can access the projector using hard-coded authentication information and control the projector maliciously...
PT-2026-77254
Name of the Vulnerable Software and Affected Versions Epson EH-TW5350 iProjection.apk version 3.2.6 Description The application contains hard-coded authentication information. An attacker can use these credentials to gain unauthorized access to a projector equipped with the iProjection function a...
Use of Hard-coded Credentials
Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...