CVE-2026-57012

In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-57012

In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-57012

A missing permission check within the Setup Wizard allows for a potential remote package install . This vulnerability can lead to a remote escalation of privilege without requiring additional execution privileges or user interaction. Exploitation details are not provided in the documents.

EUVD-2026-78992

In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-92343

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A missing permission check in the Setup Wizard allows for remote package installation. This flaw enables remote escalation of privilege without requiring...

CVE-2026-57012: Protection Mechanism Failure

In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

MAL-2026-6447 Malicious code in based-32 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52ca241d887ed83628c8c4a4432ca0f832d092e6058c7ab4250cc5b169ba7fb9 based-32 advertises itself as a zero-dependency RFC4648 Base32 encoding library, but dist/index.js ships a hidden trigger inside the exported...

Malicious code in theta-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09b0737ff5b0b0768e2314b014529b80609632a38dfdc3a9ad6cfd6ab1da9039 package.json declares postinstall: node dist/index.js, and dist/index.js executes Model.resetor at module top level — meaning both npm install...

Concrete CMS does not validate a CSRF token before processing requests to `/dashboard/extend/update/prepare_remote_upgrade/<remoteMPID>`

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepareremoteupgrade/. An attacker who controls the remote package returned for a known marketplace item ID can overwrite the package PHP on disk and force its upgrade method to...

CVE-2026-8140 Concrete CMS 9.5.0 and below is vulnerable to CSRF on download() in the package install controller

Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/. The download method in concrete/controllers/singlepage/dashboard/extend/install.php checks only the canInstallPackages permission before fetching a remote marketplace...

CVE-2026-8140

CVE-2026-8140 affects Concrete CMS 9.5.0 and below. The issue is a CSRF vulnerability in the download() function of concrete/controllers/single_page/dashboard/extend/install.php, which does not validate a CSRF token before processing requests to /dashboard/extend/install/download/. The function o...

exploit900

GoldHEN - PS4 Homebrew Enabler...

MAL-2026-2138 Malicious code in open-vp-cal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ab8c06b5d7e9b98d62708ab7377d9e18a214e884c69b0c7217979121aed06917 When executing the module, the code installs a package from a remote location. The remote package contains malicious code exfiltrating selected env variables a...

EUVD-2019-10289

Malware in sbrugna...

EUVD-2019-19052

Malware in sbrugna...

MAL-2025-3747 Malicious code in @myop/angular-remote (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c529845135f67681059adf0cf2c0ef30da66673da293016d5c193e8162f8070 Withdrawn Advisory This advisory has been withdrawn because @myop/angular-remote is not malware. This link is maintained to preserve external references...

GHSA-78M5-JPMF-CH7V GuardDog vulnerable to arbitrary file write when scanning a specially-crafted remote PyPI package

Summary Unsafe extracting using shutil.unpackarchive from a remotely retrieved tarball may lead to writing the extracted file to an unintended destination. Details Extracting files using shutil.unpackarchive from a potentially malicious tarball without validating that the destination file path is...

Democritus Project 代码问题漏洞

Democritus Project is a collection of simple, effective, modular, well-tested and well-documented features from Democritus. A code execution vulnerability exists in Democritus Project d8s-yaml version 0.1.0, which stems from the presence of a potential code execution package democritus-file-syste...

The vulnerability in the packet management subsystem of the Remote Package Manager (RPM) of the Cisco IOS XR network operating system for Cisco 8000 series routers allows a attacker to access the Redis database running on the NOSi container.

The vulnerability of the package management subsystem of the Remote Package Manager RPM in Cisco IOS XR network operating systems for Cisco 8000 series routers is related to the exposure of protected information. Exploiting this vulnerability could allow an attacker to gain access to the Redis...

python-pip: directory traversal in _download_http_url() function in src/pip/_internal/download.py

A flaw was found in the pip package installer for Python when downloading or installing a remote package via a specified URL. Improper validation of the "Content-Disposition" HTTP response header makes a path traversal attack possible, leading to an arbitrary file overwrite. This flaw allows an...