MAL-2026-12267 Malicious code in tinkoff-statist-browser-typed-client-mb.product.restrictions.arrestments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86cb27375f9846c6aeba581e7e7ec6112eefd54f8d743638a1e803bde3d46616 On require of the package's main index.js, loader.js selects a platform-specific endpoint and fetches an opaque native binary over HTTPS from a...

Malicious code in pfp-forms-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648 On require of pfp-forms-sme-registration-ooo, index.js loads polyfill.js which selects a platform-specific asset path and fetches a native binary ove...

MAL-2026-12187 Malicious code in pfp-forms-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648 On require of pfp-forms-sme-registration-ooo, index.js loads polyfill.js which selects a platform-specific asset path and fetches a native binary ove...

Exploit for Code Injection in Backupbliss Backup_Migration

CVE-2023-6553 PHP File Inclusion Leading to RCE — Backup M...

Exploit for SQL Injection in Wordpress

CVE-2023-6553 PHP File Inclusion Leading to RCE — Backup M...

Malicious code in @zzzgenesis00/near-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e6b0c979c111a298e5a63a60690d41751672624107b847cf342c49b3b8843f The package's postinstall.js lifecycle script runs on npm install and collects installer-side secrets: it enumerates a hardcoded list of...

MAL-2026-12122 Malicious code in @zzzgenesis00/near-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e6b0c979c111a298e5a63a60690d41751672624107b847cf342c49b3b8843f The package's postinstall.js lifecycle script runs on npm install and collects installer-side secrets: it enumerates a hardcoded list of...

Malicious code in @zzzgenesis00/tronweb3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e41cdeec3cc7e95a9365f12998ad095816f5e2076c4592af309634b9c95ccad0 This package impersonates the legitimate tronweb SDK author field spoofed as 'tronprotocol' and runs a malicious postinstall.js at npm install time...

MAL-2026-12124 Malicious code in @zzzgenesis00/tronweb3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e41cdeec3cc7e95a9365f12998ad095816f5e2076c4592af309634b9c95ccad0 This package impersonates the legitimate tronweb SDK author field spoofed as 'tronprotocol' and runs a malicious postinstall.js at npm install time...

gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata parser

A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using reskippascalstring without validating that offsets remain...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2026.

Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation released in July 2026. Vulnerability Details CVEID:CVE-2026-40984 DESCRIPTION: In Micrometer, it is possible for a user to provid...

gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer FILEINFO metadata parser

A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file containing a specially crafted FILEINFO metadata section, the demuxer parses variable-name and variable-value pairs using reskippascalstring without validating that offsets remain...

MAL-2026-12102 Malicious code in @wethenorth12/solana-web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54d27d76902370899c3362602581cdec59396e1ece2bd87976f1798083957f89 On require of the package's main entry index.js, the code collects process.env, hostname, username, homedir, platform, cwd and a timestamp,...

Malicious code in @wethenorth12/solana-web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54d27d76902370899c3362602581cdec59396e1ece2bd87976f1798083957f89 On require of the package's main entry index.js, the code collects process.env, hostname, username, homedir, platform, cwd and a timestamp,...

Malicious code in @wethenorth12/crypto-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d56f2c55cacbd8d06b8d3b0f20b808262c42cd002441399d8e39a2f03c600f3c On require, index.js collects process.env, hostname, username, homedir, platform, and cwd, base64-encodes the blob, and POSTs it to...

MAL-2026-12089 Malicious code in @wethenorth12/crypto-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d56f2c55cacbd8d06b8d3b0f20b808262c42cd002441399d8e39a2f03c600f3c On require, index.js collects process.env, hostname, username, homedir, platform, and cwd, base64-encodes the blob, and POSTs it to...

Malicious code in @wethenorth12/hd-key-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b2e832840746236ecbc71ba886ec793620dd508cd2a75eca04bd44e575cb03b @wethenorth12/hd-key-generator markets itself as a drop-in replacement for the popular hdkey wallet library. On require, index.js reads the full...

MAL-2026-12095 Malicious code in @wethenorth12/hd-key-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b2e832840746236ecbc71ba886ec793620dd508cd2a75eca04bd44e575cb03b @wethenorth12/hd-key-generator markets itself as a drop-in replacement for the popular hdkey wallet library. On require, index.js reads the full...

Exploit for SQL Injection in Wordpress

CVE-2026-60137 — WordPress Core SQL Injection PoC Non-destruc...

Linux Distros Unpatched Vulnerability : CVE-2026-71235

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go scrip...