KevinLAB BEMS (Building Energy Management System) - Backdoor Account

KevinLAB BEMS has an undocumented backdoor account, and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution through the RMI. An attacker could exploit this vulnerability by logging in using the backdoor account with highes...

MAL-2026-11417 Malicious code in aiprepkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7a5376398cb81f79bf581819bf1f7fad54a6e3feaaa7ded6d3b418d4562c47d5 In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

MAL-2026-11416 Malicious code in ailaunchkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a11e86f01cbd23fcc0453904b7991ddaaf87582fde3bcc3b48686a28213c46d9 In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

MAL-2026-11418 Malicious code in catalogai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ebd7348ccf6d30158d05df90e15ebba938c30119c83b2ce6679cd69068dc667b In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

MAL-2026-11414 Malicious code in aiassistcore (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f2900cfaae06740bbefca375a4d23cb6c3dd67726ace0f9cffda92c04f1c4333 In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

MAL-2026-11415 Malicious code in aichannel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 21e18e6e4016bf07f11edb272a08fb26268b2fbfe0b42a4ba502df368ce05b01 In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

EUVD-2026-51333

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName function within webserver.js when...

CVE-2026-66420

MeshCentral 1.1.21 is affected by a cross-site WebSocket hijacking vulnerability caused by an unconditional early return in CheckWebServerOriginName() in webserver.js when using self-signed certificates. This allows unauthenticated remote attackers to initiate cross-origin WebSocket connections t...

CVE-2026-66420 MeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate Deployments

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName function within webserver.js when...

CVE-2026-66420

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName function within webserver.js when...

PT-2026-66622

Name of the Vulnerable Software and Affected Versions MeshCentral version 1.1.21 Description A cross-site WebSocket hijacking protection bypass occurs when self-signed certificates are used. This is caused by an unconditional early return in the CheckWebServerOriginName function within...

EUVD-2026-50360

TeamViewer Full Client and Host for macOS before version 15.80 contain a business logic error that can allow an authenticated attacker to bypass a configured 2FA for Connections approval flow via Unattended Access and establish a remote connection to an affected macOS host...

Malicious code in fluid-type-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de176a872add830e311ef01f6432b609d41e31cbf2ec6bf2dbc473dcff5c2216 src/index.js in [email protected] contains a hidden code block, pushed off-screen by a long run of tab characters, that runs when the module is...

MAL-2026-10995 Malicious code in habingeer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 716d1a3d9969396f8ca204c03d403552bb4a990c1bfdb4a2ab05dff5afb93748 package.json declares postinstall: node test.js, which auto-runs on npm install and invokes two functions from index.js. The first recursively walks...

MAL-2026-10863 Malicious code in telebot-bot-run (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95c556b9ded1648a2523210bf518dea35324c749733eabeef3268795351b1b9c On import, telebot-bot-run 0.3 executes two attacker-controlled code paths against the installer's host. First, the top-level module fetches...

MAL-2026-10729 Malicious code in channel-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb42c8663e71b69abd887afe5b53f3c9d57bb405dd9e8ec4954eb1bf9bb0c033 The package's runtime code implements a remote command-and-control agent rather than a normal library. bin/cli.js hardcodes the endpoint...

MAL-2026-10730 Malicious code in codeam-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e8b39baa6129e1e1988002fcbeb2f62464f84fc7458f82f3754d1033a9b4ca6 codeam-cli spawns a node-pty pseudo-terminal wrapping the local Claude Code / Codex agent process and connects outbound over WebSocket to a hardcoded...

MAL-2026-10672 Malicious code in northstart-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa58bcfb4f89faf624c1f99bb552e597cc2e061330a2e98e72e6f401bb70b4f9 The pypi package northstart-sdk 0.2.1 executes attacker-controlled code as a side effect of import northstartsdk. The top-level init.py assigns...

GHSA-H4G2-XFMW-Q2C9 Clauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unset

Summary A Clauster instance bound to a non-loopback address e.g. 0.0.0.0 or a LAN IP can serve the entire dashboard and its API without any authentication — even when the operator has configured a password — if auth.enabled is left at its default false. The operator believes the instance is...

EUVD-2026-43008

RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer granted a limited session type FileTransfer, PortForward, ViewCamera, or Terminal can send control messages and login options reserved for a full Remote session. An authenticated remote pe...