Malicious code in pydanticc (PyPI)

Source: kam193 c16b176d1ba6ee3f4f1680d0678c9933e620f4de18bec7bc9af67978ed737527 Package imitates name of a popula library. During installation, obfuscated code downloads a malicious executable and starts it. It then exfiltrates at least cryptocurrency wallet data, probably more. --- Category:...

Malicious code in fastapii (PyPI)

Source: kam193 ccfc3dd07e620dc6bda1b28b4d8f77932ee217aff579270c0e0c74453e215943 Package imitates name of a popula library. During installation, obfuscated code downloads a malicious executable and starts it. It then exfiltrates at least cryptocurrency wallet data, probably more. --- Category:...

Malicious code in roboats-addition (PyPI)

Source: kam193 f9c3e8c3efcca9a56765d765638b1f7a25769a8a94693c4f391804337be55fcf During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API wrapper. The roboat.pro later robase.app domain advertise...

Malicious code in robase-utils (PyPI)

Source: kam193 e68a1df331005b75fc4c5e3aac4adf912ec273dd9c6fa671128aa73c96e3a935 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API wrapper. The roboat.pro later robase.app domain advertise...

Malicious code in neurodrift (PyPI)

Source: kam193 1b632fa784b6125daaba0e4a2b9e775bc4fec21c7d41127b887f9dfe6e873ce0 During installation, the code attempts to download and start a malicious executable. Likely related to 2025-08-raknet-testing-package. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in fetchapi-syncdata-pypi (PyPI)

Source: kam193 d0dcf5bd5c71d077b3763c74d57d68d5517a2b5c5229fdd5bd6f7369cb2a0f49 The package contains code to download and start a malicious executable. It's masqueraded using name similar to Windows services. In analyzed versions, the code was not automatically started, suggesting it's just a par...

Malicious code in airflow-provider-spirit (PyPI)

Source: amazon-inspector b565bd72c6acb3adb077ac7923ddf40d12a4922cb8bea5d22a43590e7c57d8e6 The package is advertised as an Airflow provider but src/airflowproviderspirit/init.py contains only a 20-line stub with no Airflow integration. setup.py's custom install command copies telemetry.pth into...

Rockwell Studio 5000 Logix Designer Incorrect Authorization RCE (SD1783)

The version of Rockwell Studio 5000 Logix Designer installed on the remote Windows host is affected by a remote code execution vulnerability. Due to incorrect authorization on a configuration file, any authenticated user can modify the paths of external tools configured within the application. An...

EUVD-2026-43711

A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating syst...

CVE-2026-9128 Studio 5000 Logix Designer® – Multiple Vulnerabilities

A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating syst...

CVE-2026-9128 Studio 5000 Logix Designer® – Multiple Vulnerabilities

A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating syst...

PT-2026-58083

A code execution security issue exists within Studio 5000 Logix Designer® due to an unquoted search path in the External Tools configuration. The executable paths specified in the external tools configuration file are not properly quoted, and because these paths contain spaces, the operating syst...

CVE-2026-57895

Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executable in the installation folder, which results in arbitrary code execution with SYSTEM privilege...

CVE-2026-57895

Pupsman before 3.9.0 has an incorrect default-permissions issue that allows an attacker to drop a malicious executable into the installation folder, enabling arbitrary code execution with SYSTEM privileges. Affected software: Pupsman, versions prior to 3.9.0. Root cause: default permissions misco...

CVE-2026-57895

Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executable in the installation folder, which results in arbitrary code execution with SYSTEM privilege...

PT-2026-56325

Incorrect default permissions issue exists in Pupsman versions prior to 3.9.0. An attacker can place a malicious executable in the installation folder, which results in arbitrary code execution with SYSTEM privilege...

CVE-2016-20092

NetDrive 2.6.12 contains an unquoted service path vulnerability in the Netdrive2ServiceNetdrive2 service that allows local users to execute arbitrary code with SYSTEM privileges. Attackers can insert malicious executables in the system root path that will be executed during service startup or...

CVE-2016-20087

Fortitude HTTP 1.0.4.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated privileges by exploiting the service binary path. Attackers can insert malicious executables in the system root path that execute with SYSTEM privileges during...

CVE-2021-47985 Brother SAPSprint 7.60 Unquoted Service Path Privilege Escalation

Brother SAPSprint 7.60 contains an unquoted service path vulnerability in the SAPSprint service binary that allows local attackers to escalate privileges. Attackers can place a malicious executable in the Program Files directory path to be executed with LocalSystem privileges when the service...

CVE-2016-20094 AnyDesk 2.5.0 Unquoted Service Path Elevation of Privilege

AnyDesk 2.5.0 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with SYSTEM privileges by exploiting the service installation. Attackers can insert malicious executables in the system root path that execute with elevated privileges during applicatio...