CVE-2026-85013

creationtimestamp| type| source ---|---|--- 2026-09-07 05:41:45+00:00| seen| https://bsky.app/profile/envmodules.bsky.social/post/3muvsdeyx622g...

PT-2026-86652

Name of the Vulnerable Software and Affected Versions environment-modules versions 3.2.7 through 5.6.1 Description A local attacker can exploit a flaw by placing a maliciously named modulefile in a location visible to the victim's MODULEPATH. When the victim uses Bash completion for module or ml...

CVE-2026-86438: Missing Authorization

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the marketplace over unsigned HTTP requests, achieving remote...

Linux Distros Unpatched Vulnerability : CVE-2026-85013

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in environment-modules. A local attacker can exploit this vulnerability by placing a maliciously named modulefile in a location visible to the...

Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner

Elastic Security Labs has documented four previously unreported programs associated with REVSTEALER, an emerging Windows information stealer, that remain on an infected machine after the stealer deletes itself. One of them switches off Windows Update and Microsoft Defender before running a...

CVE-2026-83627: Improper Control of Generation of Code

The Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.21.0 via the logmsg function in core/modules/class-page-cache.php. The page-cache debug log is written to...

brick (0.0.0), fox (>=0.0.9, <=1.6.2) +2 more potentially affected by unknown CVE via core-modules (0.0.0)

core-modules NPM version 0.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on core-modules and may be impacted: - brick 0.0.0 - fox =0.0.9, =3.0.0, =0.0.0, =0.0.2 Source cves: unknown CVE Source advisory: GHSA-4VFG-7HJJ-5F2F...

CVE-2026-53760: Cross-Site Request Forgery (CSRF)

Admidio is an open-source user management solution. In versions 5.0.11 and prior, the modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include...

Malicious Apache Modules Hijack Brazilian Government Site Traffic to Push Betting Pages

A Chinese-speaking cybercrime cluster known as Gambling Goblin has been observed installing malicious Apache modules on compromised web servers run by Brazilian government and educational institutions, and using them to divert visitors to attacker-controlled pages promoting online gambling and...

openSUSE 16 Security Update : go1.25-openssl (openSUSE-SU-2026:21696-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21696-1 advisory. Update to version 1.25.14 cut from the go1.25-fips-release branch at the revision tagged go1.25.14-1-openssl-fips. Security issues fixed: -...

CVE-2026-51974: Improper Control of Generation of Code

An eval injection vulnerability in the getlist function in modules/metaparser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file...

CVE-2026-82608: Out-of-bounds Read

A vulnerability was determined in Kamailio up to 5.5.0/6.0.7. This affects the function get4bytes of the file src/modules/imsregistrarscscf/cxdxavp.c of the component AVP Handler. Executing a manipulation can lead to out-of-bounds read. The attack may be performed from remote. The exploit has bee...

SecureForce

SecureForce - Penetration Testing Framework A simplified but...

Malicious Package

Overview vs-modules is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in vs-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd50c73d1e9bbca9b707d80936562866b7469239c038a540c02a9f43efedb57 package.json declares a preinstall hook that runs node resources.js, which fires automatically on npm install. resources.js is heavily obfuscated wit...

MAL-2026-15564 Malicious code in vs-modules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd50c73d1e9bbca9b707d80936562866b7469239c038a540c02a9f43efedb57 package.json declares a preinstall hook that runs node resources.js, which fires automatically on npm install. resources.js is heavily obfuscated wit...

Debian dsa-6477 : ata-modules-6.12.101+deb13-armmp-di - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6477 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6477-1 [email protected] https://www.debian.org/securit...

CVE-2026-82251 gitoxide before 0.52.1 Path Traversal via Submodule Name

gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories. Attackers can craft malicious submodule names with traversal segments to redirect state and open functions to repositories outside .git/modules...

CVE-2019-25766

A flaw was found in Renovate. During certain Go Modules update failure scenarios, temporary repository tokens are inadvertently leaked into pull request comments. A remote attacker able to view these comments could obtain the exposed tokens, leading to unauthorized access to repositories. This...

org.springmodules:spring-modules-jakarta-commons (0.7), org.springmodules:spring-modules-osworkflow (0.7) potentially affected by CVE-2026-47884 via org.springframework:spring-webmvc (2.0.1)

org.springframework:spring-webmvc MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - org.springmodules:spring-modules-jakarta-commons 0.7 -...