MAL-2026-11192 Malicious code in test2221 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6113dcb20ef051691e0cc0034132b94421604bd16a085229f75aae5c612a3d9 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail over plain HTTP, sending the...

CVE-2026-63227

An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server...

EUVD-2026-50122

An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server...

CVE-2026-63227

CVE-2026-63227 describes an unrestricted SCORM file upload vulnerability in Koollab LMS. An authenticated module designer can upload a SCORM package that contains a PHP webshell to a publicly accessible directory, enabling arbitrary code execution on the server. The CVSS 3.1 base score is 9.9 (CR...

MAL-2026-11181 Malicious code in chain-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7f9894b15a69a3c8a8cb1c75ee7c5dcb036293212fd2e29ca6676e27369ed79 The package is advertised as a docs/landing site for 'Theta Data API', but its main entry index.js re-exports a single value desKey sourced from...

Malicious code in chain-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7f9894b15a69a3c8a8cb1c75ee7c5dcb036293212fd2e29ca6676e27369ed79 The package is advertised as a docs/landing site for 'Theta Data API', but its main entry index.js re-exports a single value desKey sourced from...

Malicious code in @bowozzz/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4722e281a0d76eb608340d11a90f25453d5804124aebdd842b462fb03986891f Package is a fork of the Baileys WhatsApp Web library. A single static pattern fired on lib/Utils/generics.js where the tokens 'ping' and 'GET' appea...

MAL-2026-11176 Malicious code in @bowozzz/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4722e281a0d76eb608340d11a90f25453d5804124aebdd842b462fb03986891f Package is a fork of the Baileys WhatsApp Web library. A single static pattern fired on lib/Utils/generics.js where the tokens 'ping' and 'GET' appea...

Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js

Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan RAT associated with the DEVPOPPER malware family. The list of affected packages is as follows - @joyfill/[email protected] @joyfill/[email protected]...

GHSA-WXQQ-GCQ8-C443 vulnerabilities

Vulnerabilities for packages: langfuse-fips, langfuse...

MAL-2026-11157 Malicious code in @mypwn/hawkeye (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fc7070d4697e41f7bd953772681425e677c8ca9539144154b7abde925adef545 The OpenSSF Package Analysis project identified '@mypwn/hawkeye' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...

RockyLinux 8 : perl-IO-Compress (RLSA-2026:30858)

The remote RockyLinux 8 host has a package installed that is affected by a vulnerability as referenced in the RLSA-2026:30858 advisory. perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob CVE-2026-48962 Tenable has extracted the preceding description...

Critical Photon OS Security Update - PHSA-2026-5.0-91-0933

Updates of 'gawk' packages of Photon OS have been released...

PT-2026-65698

An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server...

Fedora 44 : kronosnet (2026-db53330c8f)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-db53330c8f advisory. CVE-2026-15811 LOW: encryption key exposure in memory after cryptographic configuration changes. Wipe cryptographic keys with explicitbzero before...

Linux Distros Unpatched Vulnerability : CVE-2026-61547

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ubuntu Linux - Unknown description CVE-2026-61547 Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenabl...

NewStart CGSL MAIN 6.06 : bluez Vulnerability (NS-SA-2026-0059)

The remote NewStart CGSL host, running version MAIN 6.06, has bluez packages installed that are affected by a vulnerability: - Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports,...

Linux Distros Unpatched Vulnerability : CVE-2026-62436

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. With the introduction of Grant...

MAL-2026-11499 Malicious code in @types-beta/sdk (npm)

The npm package @types-beta/sdk is a supply-chain dropper that impersonates the trusted @types DefinitelyTyped namespace to look like a routine type-definition dependency. It bundles a Windows executable vendor/nanocache.exe and launches it as an import-time side effect: dist/index.js calls init ...

Malicious code in @types-beta/sdk (npm)

The npm package @types-beta/sdk is a supply-chain dropper that impersonates the trusted @types DefinitelyTyped namespace to look like a routine type-definition dependency. It bundles a Windows executable vendor/nanocache.exe and launches it as an import-time side effect: dist/index.js calls init ...