80898 matches found
CVE-2026-85425
MOOS-IvP versions through 24.8.1 contain a remote code execution vulnerability in the SAY_MOOS variable handler of the iSay component. The handler passes unsanitized text to a shell command, allowing attackers to publish SAY_MOOS messages containing backticks or command substitution syntax to exe...
CVE-2026-85425 MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS
MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAYMOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAYMOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process...
CVE-2026-85425 MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS
MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAYMOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAYMOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process...
CVE-2026-85425 MOOS-IvP through 24.8.1 iSay Command Injection via SAY_MOOS
MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAYMOOS variable handler that passes unsanitized text to a shell command. Attackers can publish SAYMOOS messages containing backticks or command substitution syntax to execute arbitrary commands as the iSay process...
globalping-probe v0.52.0
Globalping Probe The Globalping platform relies on a globally distributed network of community-hosted probes, allowing anyone to run network testing commands like ping or traceroute from any location. Join the Globalping probe community Globalping thrives on the contribution of its community – wi...
Security Bulletin: MongoDB Enterprised Advanced affected by: Code Injection, Improper Check for Unusual or Exceptional Conditions, Cross-site Scripting (CVE-2026-33937, CVE-2026-33938, CVE-2026-33939, CVE-2026-33940, CVE-2026-33941)
Summary There are vulnerabilities in handlebars-4.7.7.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-33937, CVE-2026-33938, CVE-2026-33939, CVE-2026-33940, CVE-2026-33941. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-33937 DESCRIPTION:...
Security Bulletin: MongoDB Enterprised Advanced affected by: Code Injection, Prototype Pollution (CVE-2025-13465, CVE-2026-2950, CVE-2026-4800)
Summary There are vulnerabilities in lodash-4.17.21.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2025-13465, CVE-2026-2950, CVE-2026-4800. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-13465 DESCRIPTION: Lodash versions 4.0.0 through 4.17.22 are...
Malicious code in @quantixfinance/token (npm)
Source: amazon-inspector f96bd0164caad38003a2571cdf5e346be6c9d6d6ca51906a5661a2004aa3afb3 The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped keywords key, secret, token, pass, mnemonic, seed, private, wallet, rpc, infura...
Malicious code in @quantixfinance/ui (npm)
Source: amazon-inspector 32aaaa83ee6908df0267edb30ac90d4c87ef22bb803f2aca0c97b15348af95d4 The package advertises itself as a UI component library but index.js only exports empty stub Button/Input/Card functions. The real behavior is in preinstall.js, which runs automatically on npm install. That...
Malicious code in @quantixfinance/supabase (npm)
Source: amazon-inspector 957f7218e15bdaaead1d170d28c2b67949c808b52985e36ec2f993573af1312f The package's preinstall lifecycle script enumerates process.env and collects any variable whose name matches credential-shaped substrings key, secret, token, pass, mnemonic, seed, private, wallet, api, rpc,...
Malicious code in @quantixfinance/common (npm)
Source: amazon-inspector be7f05a2980d77035384d4d27df1058513e5cd1cff50fb5ce040e85986fe0231 The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list of secret-shaped substrings key, secret, token, pass, mnemonic, seed, private, wallet,...
Malicious code in @quantixfinance/sdk (npm)
Source: amazon-inspector f2fde29a3682637d696a6bb2614ba4ddf9b7f2b99c3d3a65380ced1ce3d7f57a @quantixfinance/[email protected] ships an inert library body index.js exports an empty QuantixSDK class and a createClient stub while its preinstall lifecycle script performs credential harvesting. On npm install,...
Malicious code in @quantixfinance/api (npm)
Source: amazon-inspector 574ee760d08ba89b3c9a06d87af077eac7166d12ed8a98b00a30298c0236b6e7 The package's preinstall lifecycle script runs automatically on npm install. It iterates process.env and collects every variable whose name contains credential-shaped substrings key, secret, token, pass,...
LiquidJS has an infinite loop vulnerability in its `strip_html` filter
Summary The current implementation of striphtml can cause an infinite loop when the input string contains appears after ' as the catch-all kind; a regex // equivalent is On^2 in V8 on unclosed openers. export function striphtml this: FilterImpl, v: string const str = stringifyv...
GHSA-M7FP-H3P4-HR49 LiquidJS has an infinite loop vulnerability in its `strip_html` filter
Summary The current implementation of striphtml can cause an infinite loop when the input string contains appears after ' as the catch-all kind; a regex // equivalent is On^2 in V8 on unclosed openers. export function striphtml this: FilterImpl, v: string const str = stringifyv...
envsec v1.0.0-rc.2
envsec Secure environment secrets management using native OS credential stores. Demo Features Store secrets in your OS native credential store not plain text files Cross-platform: macOS, Linux, Windows Organize secrets by context e.g. myapp.dev, stripe-api.prod, work.staging Track secret metadata...
CVE-2026-84736
In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLSCERTIFICATEVALIDATION environment variable is unset or set to false, the...
Malicious code in py-1requests (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd6d1a5c78d4368dc76a90cc90a68e4264170ed9ef208c8096251798734bb0d6 py1requests is a typosquat of the popular requests library leading 1 inserted inside the name. On import, py1requests/init.py iterates os.environ and...
MAL-2026-15861 Malicious code in py-1requests (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd6d1a5c78d4368dc76a90cc90a68e4264170ed9ef208c8096251798734bb0d6 py1requests is a typosquat of the popular requests library leading 1 inserted inside the name. On import, py1requests/init.py iterates os.environ and...
MAL-2026-15859 Malicious code in 0requests (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce3a594da2523b6481bd4639f5d3aaed9ec11a9adf92c2b99bf99d0ab6fb5b78 The package name '0requests' is a one-character variant of the popular PyPI package 'requests'. On import of the top-level package, init.py enumerate...