CVE-2026-20978

Improper authorization in KnoxGuardManager prior to SMR Feb-2026 Release 1 allows local attackers to bypass the persistence configuration of the application...

Malicious code in z-shop-event-bus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db54dce43d20da63e308cbd0ae4785225d093b5bd8b5d7c202e0f17a19ba11c2 The package z-shop-event-bus was found to contain malicious code. Source: ghsa-malware 4e51cf3a7018daddc8f2ba956f6e030ec57f8bad1e45102d29243c9dd13d48...

Malicious code in @fxinternal/netdiagnostics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e2484371522051117d2994af8795b9caef31467aaa40edfacfc8d80a45fd820 The package @fxinternal/netdiagnostics was found to contain malicious code. Source: ghsa-malware...

Malicious code in mongooose_updated (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f397bd93c8a607a5fb7cb6c4da24be0ed65157020f40d778f66f4bb8f0c6237b The package mongoooseupdated was found to contain malicious code. Source: ghsa-malware c02f092aac581da5247eba7163d5bcbb065ed41865e8eeb464ea1fedd8a4d6...

PT-2026-6088

Name of the Vulnerable Software and Affected Versions KnoxGuardManager versions prior to SMR Feb-2026 Release 1 Description A flaw exists in KnoxGuardManager that allows local attackers to bypass the application's persistence configuration due to improper authorization. Recommendations Update...

SAMSUNG Mobile devices 安全漏洞

Samsung Mobile devices are a series of mobile devices produced by South Korea’s Samsung Corporation, including smartphones and tablets. Versions of Samsung Mobile Devices prior to SMR Feb-2026 Release 1 contained security vulnerabilities. These vulnerabilities were due to improper authorization,...

Malicious code in @uselagoon/ui-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bda12522a61c5fdbf5675903128a573bb6dcf1bd1aee45a1340877450fb2112f The package @uselagoon/ui-library was found to contain malicious code. Source: ghsa-malware...

Malicious code in chai-promise-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fbc46ec5143004a3a8dbf9138d7317efd21d323b0803a9c1c6f18b73f4ef7c6 The package chai-promise-tools was found to contain malicious code. Source: ghsa-malware...

Malicious code in cookie-parsers-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4a2885cd84876f478aa25e2b8efddc48e11530aef832f085e0b9d8d114ae481 The package cookie-parsers-env was found to contain malicious code. Source: ghsa-malware...

Malicious code in supun-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a334e071b736bf620c4a29e4ec2bbaaf59bc6c3d3ab7b44603e19e9a8d95d8e9 The package supun-baileys was found to contain malicious code. Source: ghsa-malware 43ec7bfea6bfa4e623dfafee2f6f8843915886935b0d44ad5d6de4b52f72cb41...

Malicious code in aligned-array (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2e1b553bdbf785a336d224d5d3594c204455937469510cdbc423519287b2360 The package aligned-array was found to contain malicious code. Source: ghsa-malware ea83ead9b32cbe9a0c64af15ea5b84c39dad6ba94e7688ec712ceb8d1b2e8185...

Malicious code in transform-async-generator-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 338773642b9997fc33cd7f4eb7cfbca20019115fc184de55077b8b112a45dcc4 The package transform-async-generator-functions was found to contain malicious code. Source: ghsa-malware...

Malicious code in atg-atgse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4a895bff954a7aac56b4897d5f8582caded83251256152d5f9b7d55a53eedca The package atg-atgse was found to contain malicious code. Source: ghsa-malware c7041c7bfbb06e2e710b58e8aeff432e4774d756db057975426c046c7ea06339 Any...

MAL-2026-656 Malicious code in jshint-groups (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cf7ad9a58a15b025d84def4a32761ec77338fbcda7ef3ae459602eacfaf4595 The package jshint-groups was found to contain malicious code. Source: ghsa-malware fe1d6fde4a749fdb784071c856d26761b12fdceffae0020f2492a4a845eb04f4...

CVE-2026-25137

The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and download the entire database, including Odoos file store...

ShellExploit

This project is no longer supported PowerSploit is a col...

CLEANSTART-2026-BX37171 Redis is an open source, in-memory database that persists on disk

Multiple security vulnerabilities affect the redis package. Redis is an open source, in-memory database that persists on disk. See references for individual vulnerability details...

CLEANSTART-2026-MZ27698 Redis is an open source, in-memory database that persists on disk

Multiple security vulnerabilities affect the redis package. Redis is an open source, in-memory database that persists on disk. See references for individual vulnerability details...

Windows Registry Run Persistence

This Metasploit module is a Windows persistence module designed to maintain access to a compromised system after a successful exploitation and an active Meterpreter session has been obtained...

CVE-2026-25126 PolarLearn's unvalidated vote direction allows vote count manipulation

PolarLearn is a free and open-source learning program. Prior to version 0-PRERELEASE-15, the vote API route POST /api/v1/forum/vote trusts the JSON body’s direction value without runtime validation. TypeScript types are not enforced at runtime, so an attacker can send arbitrary strings e.g., "x" ...