PT-2026-64164

Name of the Vulnerable Software and Affected Versions AWS Bedrock AgentCore Python SDK versions prior to 1.18.1 Description Improper neutralization of argument delimiters in the install packages method allows a remote authenticated user to execute arbitrary commands within the Code Interpreter...

CVE-2026-62144

An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Management Server. Successful exploitation may also allow command execution on managed Security...

CVE-2026-62144

CVE-2026-62144 describes an authentication bypass in Check Point’s Security Management and Multi-Domain Security Management Server. An unauthenticated attacker can run administrative commands on the Management Server, with possible command execution on connected Security Gateways. Exploitation re...

Oracle WebLogic Server - Remote Command Execution

The Oracle WebLogic Server component of Oracle Fusion Middleware subcomponent - WLS Security is susceptible to remote command execution. Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.1.0 and 12.2.1.2.0. This easily exploitable vulnerability allows unauthenticated attacke...

CVE-2026-16488

The CVE covers QUSETIONS MiniCode-Python 0.1.0 where the subprocess.Popen call in minicode/config.py of the Project File Handler is vulnerable to OS command injection. The issue can be exploited remotely with high attack complexity and no privileges required, though user interaction is indicated ...

CVE-2026-16488

A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high...

EUVD-2026-46265

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function...

fastjson-1.2.83-gadget-rce

fastjson-1.2.83-gadget-rce Fastjson 1.2.83 getResourceAsStre...

CVE-2026-64193

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDEDERROR::decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option RFC 8914 by tokenising the raw bytes and passing the result to Perl's eval. There is some...

CVE-2026-64193

CVE-2026-64193 affects Net::DNS for Perl up to version 1.55. The vulnerability arises in Net::DNS::RR::OPT::EXTENDED_ERROR::_decompose, which tokenizes the EXTRA-TEXT field of EDNS EXTENDED-ERROR (RFC 8914) and passes the result to Perl’s eval. Some escaping is applied for $ and @, but not for ba...

CVE-2026-64193

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDEDERROR::decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option RFC 8914 by tokenising the raw bytes and passing the result to Perl's eval. There is some...

CVE-2026-64193

Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDEDERROR::decompose parses the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option RFC 8914 by tokenising the raw bytes and passing the result to Perl's eval. There is some...

MAL-2026-10863 Malicious code in telebot-bot-run (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95c556b9ded1648a2523210bf518dea35324c749733eabeef3268795351b1b9c On import, telebot-bot-run 0.3 executes two attacker-controlled code paths against the installer's host. First, the top-level module fetches...

Linux Distros Unpatched Vulnerability : CVE-2026-64193

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Net::DNS versions through 1.55 for Perl allow remote execution injection via EDNS EXTENDED ERROR. Net::DNS::RR::OPT::EXTENDEDERROR::decompose parses the...

MAL-2026-10721 Malicious code in @whalent/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13a01c1162adb93d3960d9e1b1b67095dcf0a1ea72aefa6d471d0abbbabb5d9a The package installs a whalent CLI daemon that opens a persistent WebSocket connection wss:// to a Whalent Memory gateway and, per its own README,...

MAL-2026-10706 Malicious code in @agentvox/host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a0482819726a3b7e7f36315f58ee95e3017bc649c2ea89958776c4985fe32ab The host daemon opens an outbound WebSocket connection to a hardcoded default proxy https://proxy.agentvox.bot and, on receipt of a session.open...

MAL-2026-10745 Malicious code in phantomx-tool-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e528800706b219f69d8bc87eb77203c752c8b4720e8c0b8fc04cad6df8ce1d When the tool-server bin is launched, the package establishes a persistent Socket.IO client connection to a remote orchestration server and registers...

MAL-2026-10756 Malicious code in darkglitch (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a84fec55fc625d5e2b337aafe5a9a95ff30c47403241c59dbb33543ec97311a The package installs a listener CLI darkglitch -l -b that opens a WebSocket to the hardcoded signaling host malware-signal.vercel.app and joins the...

Malicious code in @agent-link/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7018626958a160ab35a17b31ddd130ba9b6046b870f115b0fa83622b66bd912 The package's runtime connects to a hardcoded WebSocket relay default wss://msclaude.ai and dispatches messages received from that relay directly int...

MAL-2026-10705 Malicious code in @agent-link/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7018626958a160ab35a17b31ddd130ba9b6046b870f115b0fa83622b66bd912 The package's runtime connects to a hardcoded WebSocket relay default wss://msclaude.ai and dispatches messages received from that relay directly int...