Malicious Package

Overview node-net-pool is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-15570 Malicious code in node-net-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9c6bb87249429b2a3f3791589075bf872a433bd47a33b152f6809ccf94b1328 package.json declares a postinstall hook node index.js that runs automatically on npm install. The shipped index.js contains no networking or...

Malicious code in node-net-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9c6bb87249429b2a3f3791589075bf872a433bd47a33b152f6809ccf94b1328 package.json declares a postinstall hook node index.js that runs automatically on npm install. The shipped index.js contains no networking or...

CVE-2026-82473

KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade...

CVE-2026-82473 KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints

KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade...

CVE-2026-82473 KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints

KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade...

CVE-2026-82473

KubeEdge CloudCore through 1.23.1 has a missing authentication flaw on its HTTPS node task status report endpoint (port 10002 ). An unauthenticated attacker can reach this endpoint to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking furt...

CVE-2026-82473 KubeEdge CloudCore through 1.23.1 Missing Authentication on Node Task Endpoints

KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade...

CVE-2026-82448

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...

CVE-2026-82448 Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...

CVE-2026-82448

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...

CVE-2026-82448 Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...

CVE-2026-82448

Shinobi (a self-hosted CCTV/surveillance platform) contains a hardcoded connection key in its child node service prior to commit 5a76c74f . An unauthenticated attacker who can reach the child node port can present this key during the WebSocket handshake and then dispatch arbitrary SQL queries thr...

EUVD-2026-68097

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...

CVE-2026-82448 Shinobi before commit 5a76c74f Arbitrary Database Query Execution via Hardcoded Child Node Key

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...

PT-2026-83427

Name of the Vulnerable Software and Affected Versions Shinobi versions prior to commit 5a76c74f Description The child node service contains a hardcoded connection key that enables unauthenticated attackers to execute arbitrary database queries. By accessing the child node port and providing the...

PT-2026-83452

Name of the Vulnerable Software and Affected Versions KubeEdge CloudCore versions prior to 1.23.2 Description The HTTPS server in CloudCore accepts node task status reports without authentication verification. An attacker can access CloudCore on port 10002 to manipulate the status of upgrade jobs...

CVE-2026-82473: Missing Authentication for Critical Function

KubeEdge CloudCore through 1.23.1 accepts node task status reports on its HTTPS server without authentication verification. Attackers can reach CloudCore on port 10002 to mark upgrade jobs as succeeded or failed, deceiving the control plane about node upgrade status and blocking further upgrade...

CVE-2026-82448: Use of Hard-coded Credentials

Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries...

FreeBSD : Elixir -- Denial of service via uncontrolled recursion in charlist conversion (2ab3c852-d10a-4d68-be6b-80619116c33a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 2ab3c852-d10a-4d68-be6b-80619116c33a advisory. tomciopp reports: Uncontrolled recursion in the Elixir standard library lets an attacker who controls a...