Malicious code in secp256k1-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd45f2520f57a18e182ea26170f8d6d3b4296929c66dbbf2ea0eb632adb1f46a Package name mimics the widely used secp256k1 cryptography library but contains no cryptographic functionality. The declared main index.js is a singl...

MAL-2026-14255 Malicious code in secp256k1-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd45f2520f57a18e182ea26170f8d6d3b4296929c66dbbf2ea0eb632adb1f46a Package name mimics the widely used secp256k1 cryptography library but contains no cryptographic functionality. The declared main index.js is a singl...

Malicious code in commandor-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e184348abf5c5ce61ee6c4e63189411a08755e57e95dac33c666adae7c6dc2d The package's scripts/postinstall.js runs automatically on npm install and imports childprocess alongside http.request with multiple POST call sites...

MAL-2026-14198 Malicious code in txs-lib-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5575013ead36c1ebb523009215200be0a1bf61d21285ca8515573963a63e3aa5 The package's advertised getTransactions API invokes an internal loader that reads database.js — a file disguised as a product catalog — extracts eac...

Malicious code in txs-lib-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5575013ead36c1ebb523009215200be0a1bf61d21285ca8515573963a63e3aa5 The package's advertised getTransactions API invokes an internal loader that reads database.js — a file disguised as a product catalog — extracts eac...

CVE-2026-49255: Improper Neutralization of Special Elements used in an OS Command

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf, mv, and cp functions. A malicious SSH or SFTP server can provide a...

PT-2026-78655

A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23...

CVE-2026-76572: Improper Restriction of XML External Entity Reference

A vulnerability was detected in pkp pkp-lib up to 3.3.0-22/3.4.0-10/3.5.0-4. The affected element is the function transformPHP of the file classes/xslt/XSLTransformer.php. The manipulation results in xml external entity reference. The attack can be executed remotely. Upgrading to version 3.3.0-23...

CVE-2026-73974

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test treated the...

GHSA-RH9C-RQVG-F7PR linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

Summary Every Linuxfabrik check plugin that supports the shared --test argument routed through lib.lftest.test will, when --test is supplied, treat the first CSV element as a filesystem path and read its full contents as the plugin's simulated STDOUT — running as root when the plugin is invoked...

CVE-2026-55593

Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before routing state-changing requests. The...

CVE-2026-55426

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugin...

CVE-2026-53759

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 4.2.0, dbsqlite.py created SQLite databases at predictable paths in the shared /tmp directory and followed attacker-created symbolic links at those paths. An attacker who...

CVE-2026-73974 linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test treated the...

EUVD-2026-62185

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test treated the...

CVE-2026-73974 linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses its shared testing helper across check plugins. Prior to linuxfabrik-lib 6.1.0 and Linuxfabrik Monitoring Plugins 7.0.0, lib.lftest.test treated the...

CVE-2026-73974

linuxfabrik-lib (prior to 6.1.0) and Linuxfabrik Monitoring Plugins (prior to 7.0.0) contain an arbitrary root file-read vulnerability in the lib.lftest.test() helper. The hidden --test argument (mapped to argparse.SUPPRESS, invisible in --help but accepted at runtime) treats its first or second ...

CVE-2026-55426

The shell_exec() function in linuxfabrik-lib splits command strings on pipe characters, enabling command injection via attacker-controlled arguments (e.g., --repo '|touch /root/nagios-was-here|') in plugins like restic-check. If a plugin is in the sudoers file, a compromised nagios/icinga account...

CVE-2026-55426 linuxfabrik-lib: Local privilege escalation using embedded command

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugin...

CVE-2026-55426 linuxfabrik-lib: Local privilege escalation using embedded command

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands. From the earliest affected releases until linuxfabrik-lib 5.0.0 and Linuxfabrik Monitoring Plugin...