MAL-2026-10133 Malicious code in stella-ai-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 936d3c8bc6611b58f5321ba5aab651bb3d2db821d172816283ca04633be00863 The stella CLI shipped in bin/stella.js prompts users for their phone number and the WhatsApp verification code and POSTs both to a hardcoded bare-IP...

CVE-2026-38059

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID DID, Terminal Private Key identifier TPK, MAC address, and exact firmwa...

EUVD-2026-42908

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID DID, Terminal Private Key identifier TPK, MAC address, and exact firmwa...

CVE-2026-38059 ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID DID, Terminal Private Key identifier TPK, MAC address, and exact firmwa...

CVE-2026-38059

The CVE-2026-38059 entry concerns iDirect iQ200 devices where the /api/identity and /api/ REST endpoints are exposed without authentication. An unauthenticated attacker with network access can retrieve sensitive device data including serial number, Device ID (DID), Terminal Private Key (TPK) iden...

MINI-8C49-8MMF-XMCF

Bulletin has no description...

MINI-HJX6-MXH8-3589

Bulletin has no description...

CVE-2026-13347

creationtimestamp| type| source ---|---|--- 2026-07-10 11:16:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbzis5yut2y 2026-07-10 12:15:24+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-13347 2026-07-12 18:01:08+00:00| seen|...

CVE-2026-28564

creationtimestamp| type| source ---|---|--- 2026-07-10 10:58:20+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqbyj7nlat2y 2026-07-10 12:15:27+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-28564 2026-07-10 13:10:06+00:00| seen|...

CVE-2026-15300

creationtimestamp| type| source ---|---|--- 2026-07-10 05:18:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqbfirxvof2v 2026-07-10 06:00:26+00:00| seen| https://infosec.exchange/users/offseq/statuses/116894153133982870 2026-07-10 06:00:28+00:00| seen|...

PT-2026-57166

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID DID, Terminal Private Key identifier TPK, MAC address, and exact firmwa...

MINI-482W-65MF-4R7V

Bulletin has no description...

MINI-67V5-CG2P-74RX

Bulletin has no description...

ECHO-4348-B766-AC2A

Bulletin has no description...

MINI-RH8P-M8W5-628Q

Bulletin has no description...

MINI-32V8-R28H-V55G

Bulletin has no description...

CGA-W992-2C5M-55J4

Bulletin has no description...

PYSEC-2026-3382 Segfault if `tf.histogram_fixed_width` is called with NaN values in TensorFlow

Impact The implementation of tf.histogramfixedwidth is vulnerable to a crash when the values array contain NaN elements: python import tensorflow as tf import numpy as np tf.histogramfixedwidthvalues=np.nan, valuerange=1,2 The implementation assumes that all floating point operations are defined...

PYSEC-2026-3342 Missing validation causes denial of service via `Conv3DBackpropFilterV2`

Impact The implementation of tf.rawops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack: python import tensorflow as tf tf.strings.unsortedsegmentjoin inputs='123', segmentids=0, numsegments=-1...

Missing validation causes denial of service via `UnsortedSegmentJoin`

ImpactThe implementation of tf.rawops.UnsortedSegmentJoin does not fully validate the input arguments. This results in a CHECK-failure which can be used to trigger a denial of service attack:pythonimport tensorflow as tftf.rawops.UnsortedSegmentJoin inputs=tf.constant"this", shape=12,...