Malicious code in coinscan (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 021da2d8a1de0971203de68e083eeb30efc18b58ebc5b36ecde89eb03b02cf9e setup.py imports coinscan.telemetry and calls check during install. check fetches a JSON manifest from...

CVE-2026-93304

A (D)TLS 1.2 client is vulnerable to an out-of-order ChangeCipherSpec message being accepted before the ClientKeyExchange is sent. Because the master secret is not yet derived, the client installs read keys from a known deterministic key, allowing a man-in-the-middle attacker to complete the hand...

CVE-2026-93304 (D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange

A DTLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a known deterministic key and checks the server's Finished against that same key. An out-of-order...

CVE-2026-93304

A DTLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a known deterministic key and checks the server's Finished against that same key. An out-of-order...

EUVD-2026-87909

A DTLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a known deterministic key and checks the server's Finished against that same key. An out-of-order...

CVE-2026-93304 (D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange

A DTLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a known deterministic key and checks the server's Finished against that same key. An out-of-order...

CVE-2026-93304 (D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange

A DTLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a known deterministic key and checks the server's Finished against that same key. An out-of-order...

MAL-2026-17195 Malicious code in claudedashbord (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e847280dc7dd5b1a2001ec8e048f961b1be2e341889e02233c4f43e48fe0d56 The package installs a.pth file that CPython auto-executes on every Python interpreter startup. The.pth imports claudedashbord.telemetry and calls...

Malicious code in claudedashbord (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e847280dc7dd5b1a2001ec8e048f961b1be2e341889e02233c4f43e48fe0d56 The package installs a.pth file that CPython auto-executes on every Python interpreter startup. The.pth imports claudedashbord.telemetry and calls...

MAL-2026-17196 Malicious code in donutpromotion (PyPI)

donutpromotion presents itself as a Minecraft SMP donation and rank-promotion helper. The published 0.1.0 sdist instead executes an encrypted downloader before setuptools processes the package. The automated package report identified a critical py-download-and-execute signal at...

Malicious code in donutpromotion (PyPI)

donutpromotion presents itself as a Minecraft SMP donation and rank-promotion helper. The published 0.1.0 sdist instead executes an encrypted downloader before setuptools processes the package. The automated package report identified a critical py-download-and-execute signal at...

Malicious code in donutautosellsrc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef01bfa158639900e5ad9301eb32db37e7dab821e55ccff29574b905a8e5a2cb setup.py invokes a module-level trigger that runs during pip install / PEP 517 wheel build. The trigger calls donutautosellsrc.build.run, which...

MAL-2026-17192 Malicious code in donutautosellsrc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef01bfa158639900e5ad9301eb32db37e7dab821e55ccff29574b905a8e5a2cb setup.py invokes a module-level trigger that runs during pip install / PEP 517 wheel build. The trigger calls donutautosellsrc.build.run, which...

PT-2026-99707

A security vulnerability has been detected in zhistaredu StarTraining up to 3.8.1. This issue affects some unknown processing of the file application.yml. Such manipulation of the argument xss.enabled leads to cross site scripting. It is possible to launch the attack remotely. Attacks of this...

PT-2026-99514

Name of the Vulnerable Software and Affected Versions wolfSSL affected versions not specified Description A DTLS 1.2 client may accept a ChangeCipherSpec message before sending its ClientKeyExchange. Since no master secret is derived at this stage, the client uses read keys derived from a known...

CVE-2026-93304: Incorrect Behavior Order

A DTLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point, so the client installs read keys derived from a known deterministic key and checks the server's Finished against that same key. An out-of-order...

Linux Distros Unpatched Vulnerability : CVE-2026-94419

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Without NOSESSIONCACHEREF, wolfSSLgetsession does not return a session object but a ClientSession reference of the form row, index, hashsessionID into the...

Improper Validation of Specified Quantity in Input

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the addressparser module's handling of quoted local-part addresses. When an address of the form...

CVE-2026-100708 Froxlor before 2.3.13 Private Key Disclosure via Certificates API

Froxlor before 2.3.13 returns the sslkeyfile column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of the Certificates.get and Certificates.listing API commands, because the results of the underlying domainsslsettings queries are passed through...

CLEANSTART-2026-HX71601 in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it

Security vulnerability affects the loki package. The in-memory keyring returned by NewKeyring silently accepted keys with the ConfirmBeforeUse constraint but never enforced it...