Malicious code in tailwind-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb0348430af0110be6ac537a38b5bb98983ec6b6f8f1474778ff16e4a4f4e8d8 dist/index.js appends an evalatob'...' payload after the legitimate export default scrollbarHide; line. The decoded payload queries Ethereum RPC...

CVE-2026-18900

CVE-2026-18900 affects H3C NX15 V100R017 in the Backend RPC component, specifically the file.exec function under /api/esps. The vulnerability arises from manipulation of the File argument, enabling OS command injection. The issue can be triggered remotely, and public exploits exist. The vendor ha...

CVE-2026-18900 H3C NX15 Backend RPC esps file.exec os command injection

A weakness has been identified in H3C NX15 V100R017. This impacts the function file.exec of the file /api/esps of the component Backend RPC. This manipulation of the argument File causes os command injection. The attack may be initiated remotely. The exploit has been made available to the public...

CVE-2026-18787

A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function removerule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out...

CVE-2026-18787 GL.iNet AX1800 RPC Endpoint oui-rpc.lua remove_rule command injection

A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function removerule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out...

CVE-2026-18787

CVE-2026-18787 affects GL.iNet AX1800 firmware up to 4.8.3. The vulnerability resides in the RPC Endpoint component, specifically the function remove_rule in /usr/share/gl-ngx/oui-rpc.lua, where manipulation of the argument args.id leads to a command injection . The attack can be carried out remo...

CVE-2026-18787

A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function removerule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out...

EUVD-2026-52797

A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function removerule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The attack is possible to be carried out...

p11-kit security update

An update is available for p11-kit. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The p11-kit packages provide a mechanism to manage PKCS11 modules. The...

RLSA-2026:49667 Moderate: p11-kit security update

The p11-kit packages provide a mechanism to manage PKCS11 modules. The p11-kit-trust subpackage includes a PKCS11 trust module that provides certificate anchors and black lists based on configuration files. Security Fixes: p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing...

EUVD-2026-52547

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.adduser of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in command injection. The attack can be initiated remotely. The exploit is now publi...

Important: freerdp

Issue Overview: Heap-buffer-overflow write in TS Gateway RPC fragment receive due to uncapped bindack maxxmitfrag On TS Gateway connections, rpc-maxrecvfrag is initialized to 0x0FF8 4088 and ReceiveFragment is allocated to that size. In rpcbind.c, the client assigns rpc-maxrecvfrag =...

Moderate: Red Hat Security Advisory: p11-kit security update

An update for p11-kit is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing

A flaw was found in p11-kit. The RPC message attribute parsing functions p11rpcmessagegetattribute and p11rpcmessagegetattributearrayvalue form a mutually-recursive call chain with no recursion depth limit when processing nested CKAWRAPTEMPLATE, CKAUNWRAPTEMPLATE, and CKADERIVETEMPLATE attributes...

CVE-2026-69096 OpenWrt luci-app-dockerman Read ACL Remote Code Execution

OpenWrt luci-app-dockerman LuCI master and openwrt-25.12 snapshots containing the ucode dockerrpc.uc RPC backend after the JS/ucode conversion contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker. / docker.container., which exposes the...

CVE-2026-18598

A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.getsystemlog of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC plugin. The manipulation of the argument module results in command injection. The attack can be...

CVE-2026-18599

A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.setconfig of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument recordsize causes command injection. The exploit has been published...

CVE-2026-18600 GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch_status command injection

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switchinfo/network.switchstatus of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack ma...

EUVD-2026-52267

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switchinfo/network.switchstatus of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack ma...

CVE-2026-18600

GL.iNet GL-MT3000 devices (firmware up to 4.4.5) are affected by a vulnerability in the Network Lua RPC Plugin, specifically in network.switch_info/network.switch_status in /usr/lib/oui-httpd/rpc/network. Manipulating the switch argument enables remote command injection. The exploit has been publ...