Malicious code in qzc690382 (PyPI)

Source: amazon-inspector b34d702840be6773d3d41444f836f45dab6a8e3524fcc8e4cd6d224ac3a77f1e The package body is inert init.py contains only c\n; the entire functionality lives in setup.py, which runs on pip install. During install, setup.py writes a Python HTTP server script to /tmp/.kxs and launch...

Malicious code in qzc690382 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b34d702840be6773d3d41444f836f45dab6a8e3524fcc8e4cd6d224ac3a77f1e The package body is inert init.py contains only c\n; the entire functionality lives in setup.py, which runs on pip install. During install, setup.py...

MAL-2026-18749 Malicious code in qzc690382 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b34d702840be6773d3d41444f836f45dab6a8e3524fcc8e4cd6d224ac3a77f1e The package body is inert init.py contains only c\n; the entire functionality lives in setup.py, which runs on pip install. During install, setup.py...

CVE-2026-88285

GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service that requires no authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands. The underlying cause is the lack of an authentication mechanism on the service itself. The CVSS v3...

GHSA-2R5Q-H53F-9RP3 @yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

PT-2026-89211

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

EUVD-2026-63470

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...

GO-2026-5317 Tilt: Missing authentication on the network-exposed Tilt HUD server in github.com/tilt-dev/tilt

Tilt: Missing authentication on the network-exposed Tilt HUD server in github.com/tilt-dev/tilt...

CVE-2026-9717

CWE-78 Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could allow unauthorized execution of commands with elevated privileges, impacting system integrity, confidentiality, and availability when a privileged authenticated user interacts wi...

CVE-2026-9718

CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-service condition, impacting system availability when a specially crafted request is sent to a vulnerable network-exposed service...

CVE-2026-9718

Technical details about CVE-2026-9718 are not publicly available in the provided documents; monitor for updates from official advisories.

EUVD-2026-39434

CWE-78 Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could allow unauthorized execution of commands with elevated privileges, impacting system integrity, confidentiality, and availability when a privileged authenticated user interacts wi...

CVE-2026-9717

CWE-78 Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could allow unauthorized execution of commands with elevated privileges, impacting system integrity, confidentiality, and availability when a privileged authenticated user interacts wi...

PT-2026-52486

CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-service condition, impacting system availability when a specially crafted request is sent to a vulnerable network-exposed service...

CVE-2026-45727

CloakBrowser is a tool to bypass bot detection tests. Prior to version 0.3.28, the cloakserve CDP multiplexer uses the user-supplied fingerprint query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakser...

Missing Authentication for Critical Function

Overview vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the fetchModule method exposed through the WebSocket interface when the server is explicitly exposed to the network and WebSocket is enable...

CVE-2026-34980

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server...

Exploit for CVE-2025-11953

React Native CLI Command Injection Demo CVE-2025-11953 ⚠...

CVE-2025-54923

CVE-2025-54923 affects Schneider Electric EcoStruxure Power Monitoring Expert (and related modules) with a deserialization of untrusted data vulnerability that can lead to remote code execution. Public sources in the connected set describe an issue in the GetFilteredSinkProvider/unsafe deserializ...