Malicious code in easypanel-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eb103b6863369372ba8c07701264f8b0f6b57e3217e07912c8efbd9371c648f The package's preinstall lifecycle script preinstall.js executes automatically on npm install and collects the installer's hostname, OS username,...

Malicious code in easypanel-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ac486399ab6c99cf83bfcf80e487c414fd29430e27f0d929ff7034ed333c7e8 The package's preinstall lifecycle script runs automatically on npm install and collects installer-side identifiers — os.hostname,...

MAL-2026-16074 Malicious code in easypanel-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ac486399ab6c99cf83bfcf80e487c414fd29430e27f0d929ff7034ed333c7e8 The package's preinstall lifecycle script runs automatically on npm install and collects installer-side identifiers — os.hostname,...

Malicious code in easypanel-hosting (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db6a378b33bb2f33088ed90db4ac48e81368e30d5ef38578dca3b4345e9cb06b [email protected] ships a stub index.js module.exports = and an npm preinstall lifecycle script that collects the installer's hostname, usernam...

MAL-2026-16075 Malicious code in easypanel-hosting (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db6a378b33bb2f33088ed90db4ac48e81368e30d5ef38578dca3b4345e9cb06b [email protected] ships a stub index.js module.exports = and an npm preinstall lifecycle script that collects the installer's hostname, usernam...

Security Bulletin: Multiple Vulnerabilities in watsonx.data

Summary Multiple vulnerabilities were addressed in watsonx.data 2.4.0 patch 5 version, which was present in different version from watson.data 2.4.0 Vulnerability Details CVEID:CVE-2026-53537 DESCRIPTION: Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30,...

PT-2026-89265

Name of the Vulnerable Software and Affected Versions Builderall Cheetah For Wp versions prior to 3.0.3 Description Unauthorized modification of data is possible due to a missing capability check in the disable function. The wp ajax ba cheetah disable AJAX handler is registered without capability...

SPIP Autosave Session Unauthenticated Remote Code Execution

This Metasploit module exploits an unauthenticated RCE in SPIP less than or equal to 4.4.21 via the forum autosave session handler. The action=session endpoint allows any visitor to store arbitrary data in a PHP session variable. By writing PHP code into an autosaveforum session key, the code is...

PT-2026-89191

Summary In a process run with full administrative rights on Windows, gix-sec wrongly treats all locations as trusted, leading to the execution of commands configured in repositories controlled by limited user accounts. Details In a similar way to Git, gitoxide tries to avoid operating in local...

PT-2026-102350

Name of the Vulnerable Software and Affected Versions PyJWT versions 2.13.0 through 2.13.x Description The HMACAlgorithm.from jwk function is affected because the PyJWK verification path uses the decoded key without applying prepare key validation. This occurs when a trusted JSON Web Key JWK Set...

ROS-20260909-73-0123

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors during variable initialization. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

ROS-20260909-73-0034

The vulnerability in Chromium is related to errors during variable initialization. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260909-73-0068

The vulnerability in Chromium is related to errors during variable initialization. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2026-89171

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.5 through 0.11.0 Description An issue exists in the channel branch of the chat completions handler where the system verifies if a user has write access to a channel and if a specific message belongs to that channel, but...

ROS-20260909-73-0013

The vulnerability in Chromium is related to errors during variable initialization. Exploiting this vulnerability can allow an attacker to cause a service failure...

ROS-20260909-73-0145

The vulnerability of the ANGLE web browser component in Google Chrome is related to errors during variable initialization. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

PT-2026-89194

Name of the Vulnerable Software and Affected Versions eKuiper versions prior to 2.4.1 Description A path traversal issue in administrative management endpoints allows privileged users or attackers with access to management APIs to delete arbitrary files or directories on the host system. In the...

PT-2026-89173

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.6 through 0.11.0 Description An issue exists in the SafePlaywrightURLLoader component within backend/open webui/retrieval/web/utils.py affecting both sync and async request interceptors. The system validates a...

ROS-20260909-73-0061

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to errors during variable initialization. Exploiting this vulnerability can allow a malicious actor to cause service interruptions through a specially created HTML page...

Linux IIO ADC mt6358_read_imp() Unprotected Information Disclosure

The vulnerability of the mt6358readimp function in the drivers/iio/adc/mt6359-auxadc.c file of various types of built-in sensors in the Linux operating system is related to the use of an uninitialized variable. Exploiting this vulnerability could allow an attacker to gain unauthorized access to...