MAL-2026-10219 Malicious code in chai-as-precision (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8b5d1218fae5d91755d8f9ca8ed37983e7d589c6fd88012d3ddb29a84a2cc56 Package is published as chai-as-precision but its shipped code mimics pino exports middleware.pino, ships pino.js/proto.js/redaction.js, a name/purpo...

CVE-2026-15553

The CVE-2026-15553 entry concerns Ragic’s Enterprise Cloud Database with an Arbitrary File Upload vulnerability that allows unauthenticated remote attackers to upload malicious files and have them downloaded by users. Affected component is the Cloud Database service; the root cause is an insecure...

Malicious code in pure-folder-three (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e83bf74d7c84c48a1a478d7bb40bbd899c4fda613f1512b66184d3de478b480 [email protected] executes attacker-controlled shell commands on install and on import. The postinstall entry src/build.js decodes an obfuscate...

Malicious code in dotnet-runtime-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c10c75766303f8c3bf261487e341e537f103116026309006ab71d977aacdd235 The package's postinstall lifecycle script package.json line 7: "postinstall": "node install.js" runs install.js, which on Windows writes a PowerShel...

MAL-2026-10217 Malicious code in dotnet-runtime-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c10c75766303f8c3bf261487e341e537f103116026309006ab71d977aacdd235 The package's postinstall lifecycle script package.json line 7: "postinstall": "node install.js" runs install.js, which on Windows writes a PowerShel...

Malicious code in node-sysmetrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e624a951ebd9352b2b8d47bf80d418a01674640ec2d2b2592f00bb446f110c68 On npm install, install.js executes as a postinstall script and drops a detached background Node process at /tmp/.sysm-agent.js that persists after...

MAL-2026-10216 Malicious code in node-sysmetrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e624a951ebd9352b2b8d47bf80d418a01674640ec2d2b2592f00bb446f110c68 On npm install, install.js executes as a postinstall script and drops a detached background Node process at /tmp/.sysm-agent.js that persists after...

PT-2026-57864

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2025.9 and earlier ColdFusion versions 2023.20 and earlier Description An Uncontrolled Search Path Element issue exists that could allow arbitrary code execution in the context of the current user. This occurs when the...

PT-2026-59511

Impact An attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. Patches Patched version: 12.2.0. PdfParser introduced in Pillow 4.2.0 follows Prev pointers in PDF trailers to read cross-reference sections. If ...

PT-2026-60013

Impact Malicious algorithms can potentially access other algorithms input and output files. Patches Todo Workarounds Verify and restrict the algorithm containers that are allowed to run on your node. See here on how to do this. References https://docs.vantage6.ai/usage/running-the-node/security F...

PT-2026-57756

Name of the Vulnerable Software and Affected Versions Aimogen Pro versions prior to 2.8.4 Description An unauthenticated arbitrary file upload issue exists in the Aimogen Pro plugin for WordPress. This flaw allows remote attackers to upload malicious files of dangerous types to the server without...

PT-2026-57865

Name of the Vulnerable Software and Affected Versions ColdFusion versions 2025.9 and earlier ColdFusion versions 2023.20 and earlier Description An Uncontrolled Search Path Element issue exists that could allow arbitrary code execution in the context of the current user. This occurs when the...

MAL-2026-10228 Malicious code in chat-adapter-zoom (npm)

The chat-adapter-zoom package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a Zoom...

BIT-NEXTCLOUD-2021-32695 Malicious Android app could access Shared Preferences of the Nextcloud Android client

Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.16.1, a malicious app on the same device could have gotten access to the shared preferences of the Nextcloud Android application. This required user-interaction as a victim had to initiate the sharing flow and choos...

BIT-NEXTCLOUD-2021-32694 Malicious Android application can crash the Nextcloud Android Client

Nextcloud Android app is the Android client for Nextcloud. In versions prior to 3.15.1, a malicious application on the same device is possible to crash the Nextcloud Android Client due to an uncaught exception. The vulnerability is patched in version 3.15.1...

MAL-2026-10215 Malicious code in fast-dotenv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da3250a4b69ccce49128d2e75ffb9e577746de4fb3afe0e0d242fbe5d094d02d The package presents itself as a.env loader but on load/config spawns a background thread that, after a 72–96 hour activation delay jittered by...

Malicious code in babel-preset-lib-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4274de0136aa69f8b0f4eba03412c7809a1b8c2446bb3ed7f6de1333475aa4c4 index.js, the package main, runs a load-time IIFE that collects OS platform and architecture, hostname, username, private and public IP via...

MAL-2026-10214 Malicious code in babel-preset-lib-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4274de0136aa69f8b0f4eba03412c7809a1b8c2446bb3ed7f6de1333475aa4c4 index.js, the package main, runs a load-time IIFE that collects OS platform and architecture, hostname, username, private and public IP via...

MAL-2026-10212 Malicious code in vuln-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8bd105bf3b12062f312b41f2a1eead5e8481f8d3749fc78bc79ed8675c11394 On npm install, the package's preinstall script triggers a DNS lookup to a unique subdomain of oast.fun fabekzbnjtufpffkzzmvjvi5eafhny3ok.oast.fun, a...

MAL-2026-10210 Malicious code in mcp-notes-server-poc-praetorian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a926b6d3f87c9242af654ce9379abe9e511aa6366efe7667822080968c66f65 On startup of the CLI/bin entry, [email protected] issues an unconditional HTTPS GET to the hardcoded host ft8swuagwwf6newi.ixx.s...