266372 matches found
Malicious code in power-assert-plus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff97d4bae356db6a165ae845ee186c814f89bd1ee40e839d6da054965bfbd823 power-assert-plus is a typosquat of power-assert. On every require, index.js detach-spawns node build/power-assert-plus.js. That build file is...
Malicious code in postcss-initialize-plugin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c75b316d71a07c70e033fe47d5a3efbd6c3dbccb3b1ae8466a4d325c0d1ada79 postcss-initialize-plugin is a typosquat of postcss-initial. Its README, repository URL, and author metadata are copied verbatim from...
Malicious code in single-flight-lock (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbe4ec28aff41ab4793722dc5975c5639762d2dc2ed23827d71d410283993ca4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-14014 Malicious code in try-lock-runner (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 941a65c056bbb40a20dd7b1f4107bf804df157df12ea0b89067fc6770afe3b6b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration ZCS before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send...
CVE-2026-73570
In Zimbra Collaboration (ZCS) before 10.1.20, with the optional zimbra-snmp package installed and SNMP notifications enabled, improper sanitization of untrusted input during SNMP notification processing allows an unauthenticated attacker to send crafted SMTP requests that execute arbitrary OS com...
CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration ZCS before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send...
CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration ZCS before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send...
CVE-2026-73570
A remote code execution vulnerability exists in Zimbra Collaboration ZCS before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send...
EUVD-2026-58069
A remote code execution vulnerability exists in Zimbra Collaboration ZCS before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send...
DEBIAN-CVE-2026-53784
rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir to the module root at session initialization withou...
c3p0: c3p0: Remote code execution via deserialization vulnerability
A flaw was found in c3p0, a JDBC Connection pooling library. This vulnerability allows a remote attacker to potentially execute arbitrary code by crafting a malicious data source object. When an application deserializes this object and automatically resolves its properties, it can trigger...
com.mchange/mchange-commons-java: mchange-commons-java: Remote code execution via JNDI injection
A flaw was found in mchange-commons-java, a Java utility library. This vulnerability allows a remote attacker to achieve arbitrary code execution through Java Naming and Directory Interface JNDI injection. The library's JNDI ObjectFactory can construct objects of arbitrary classes and initialize...
org.apache.camel/camel-vertx-http: Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data
A flaw was found in the camel-vertx-http component of Apache Camel. This vulnerability, a Deserialization of Untrusted Data, could allow a remote attacker to execute arbitrary code. By controlling the backend server or acting as a man-in-the-middle, an attacker could send a specially crafted...
CVE-2026-70461 rsync 3.2.5 < 3.5.0 Heap Out-of-Bounds Write via files-from Entry
rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsyn...
CVE-2026-27544
Unauthenticated Remote Code Execution RCE in QA Analytics = 5.2.0.0 versions...
CVE-2026-27380
Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...
CVE-2026-66256 Apache Shindig Common, Apache Shindig Social-Api: Remote Code Execution via XStream deserialization (OpenSocial REST API)
UNSUPPORTED WHEN ASSIGNED Deserialization of Untrusted Data vulnerability in Apache Shindig. This issue affects Apache Shindig: all versions. Users with access to the Shindig REST API can send specially-crafted requests to trigger arbitrary code execution on the server. As this project is retired...