meesho-android-improper-encryption-cve-2026-5682

🔐 Proof of Concept: Meesho Android App – Insecure Cryptographic Implementation AES-CBC without Integrity + Weak Key Derivation Author: Soyam Arya aka honestcorrupt Date of Discovery: March 2026 Affected App: Meesho Android App com.meesho.supply Status: Under Verification Category: Insufficient...

CVE-2026-105137

A vulnerability was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of the component Build Process. The manipulation results in download of code without integrity check. The attack can be launched remotely. A high complexity level is associated with...

EUVD-2026-92085

A vulnerability was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of the component Build Process. The manipulation results in download of code without integrity check. The attack can be launched remotely. A high complexity level is associated with...

CVE-2026-105137 Laradock Build Process Dockerfile code download

A vulnerability was found in Laradock up to 20.4. Impacted is an unknown function of the file workspace/Dockerfile of the component Build Process. The manipulation results in download of code without integrity check. The attack can be launched remotely. A high complexity level is associated with...

CVE-2026-93534 spatie Scotty Self Update SelfUpdater.php update code download

A vulnerability was identified in spatie Scotty up to 1.4.2. Affected is the function SelfUpdater::update of the file app/Updater/SelfUpdater.php of the component Self Update Handler. Such manipulation leads to download of code without integrity check. It is possible to launch the attack remotely...

CVE-2026-79963

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command executi...

CVE-2026-78574

The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the conte...

Malicious code in framework-zero (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfa0b9f3bb077648bf715ae13565ed44e67471548c98861bd5fb4d9472a3223b package.json line 11 declares a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/framework-zero instead of a registry...

MAL-2026-15520 Malicious code in ring-device-settings-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3ea2aed3d7e8c0b9c99532d6714c486a5ad685418ebbd96c67b44b63f79fe01 package.json declares a dependency whose key equals the package's own name ring-device-settings-library and whose value is a raw HTTPS URL pointing a...

Malicious code in integration-amplitude (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd9ffdf0c07f64af4034ec76aea284a6290f4633f2c80eefa65579c1a297bfb package.json declares the package's own name as a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/integration-amplitude...

MAL-2026-15510 Malicious code in integration-amplitude (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcd9ffdf0c07f64af4034ec76aea284a6290f4633f2c80eefa65579c1a297bfb package.json declares the package's own name as a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/integration-amplitude...

CVE-2026-75569 Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

EUVD-2026-63086

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

PT-2026-78701

Name of the Vulnerable Software and Affected Versions mce-operator-bundle affected versions not specified Description The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning fixing a specific version of a commit or...

CVE-2026-74872 openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool

opensslencrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpoolpy313.so pattern in...

Malicious code in dolyame-ui-inputsearchtagged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9880fbbce0555f24a1b8910b6271c9b74bd210c1e2aad74bee6ef21338c2eff3 On require of the package, init.js selects a platform-specific payload, downloads opaque bytes over HTTPS from a rotating set of anonymous Cloudflare...

MAL-2026-13583 Malicious code in dolyame-ui-inputsearchtagged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9880fbbce0555f24a1b8910b6271c9b74bd210c1e2aad74bee6ef21338c2eff3 On require of the package, init.js selects a platform-specific payload, downloads opaque bytes over HTTPS from a rotating set of anonymous Cloudflare...

Malicious code in dolyame-ui-selectaccount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4974c35a90cc1879876080c49f8fafc0f9be576e04e19597d364b55daa951363 On require of the package, index.js loads bootstrap.js and the main-exported lib/telemetry.js, both of which implement the same download-and-execute...

Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...

MAL-2026-13283 Malicious code in dolyame-boxy-atom-bnpl-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 963f070cd6563a11008f0726b4e0a11e5612dce9b53c58d9ea537566ab1774e2 On require, index.js loads helpers.js which fetches a platform-specific binary from obfuscated hosts assembled via array-join oob-worker.cf.workers.d...