AlmaLinux 8 : dracut (ALSA-2026:54575)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:54575 advisory. dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die CVE-2026-15816 Tenable has extracted the preceding...

CVE-2026-17209: Improper Neutralization of Input During Web Page Generation

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...

AlmaLinux 10 : dracut (ALSA-2026:54576)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:54576 advisory. dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die CVE-2026-15816 Tenable has extracted the precedin...

RockyLinux 10 : dracut (RLSA-2026:54576)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:54576 advisory. dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die CVE-2026-15816 Tenable has extracted the precedi...

Malicious code in preinstall-hook-webhook-callback-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6e707d55368c2628038e0efaac35629fba6dbd520e66a7e29f9c6a86c69b2e1 package.json declares a preinstall lifecycle script that contacts webhook.site, an ephemeral request-capture service commonly used as an...

MAL-2026-13990 Malicious code in wct-st (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3065a54d66ae4872334224443453c85f98c9ab8ae9d87df215bb51a5ba5e7595 On npm install, the package's postinstall lifecycle script collects installer host identifiers hostname, platform, architecture, Node.js version,...

Malicious code in wct-st (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3065a54d66ae4872334224443453c85f98c9ab8ae9d87df215bb51a5ba5e7595 On npm install, the package's postinstall lifecycle script collects installer host identifiers hostname, platform, architecture, Node.js version,...

Malicious code in @secauditb20y/sec-test-r3b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df7034b94531c8be5e9141c7a5cf73f552486c1b307672346a0e646e60207b7c package.json declares a postinstall script that runs node -e to invoke fs.writeFileSync, creating /tmp/PWNR3REAL/FIRED on the installer's machine whe...

MAL-2026-13989 Malicious code in @secauditb20y/sec-test-r3b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df7034b94531c8be5e9141c7a5cf73f552486c1b307672346a0e646e60207b7c package.json declares a postinstall script that runs node -e to invoke fs.writeFileSync, creating /tmp/PWNR3REAL/FIRED on the installer's machine whe...

CVE-2026-73660 FreePBX: Authenticated TTS AGI Command Injection Through TTS Name

FreePBX is an open source IP PBX. Prior to 16.0.6 and 17.0.5.4, the FreePBX Text-To-Speech module allows an authenticated administrator to save a TTS destination name that is HTML-encoded for storage, decoded during dialplan generation, passed as an AGI argument, and used to build filenames insid...

Malicious code in notafollower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e076dd548fea7ce80a77e7810b30c0a5d95c0b6ae4bf3d929281da70dbec1768 [email protected] declares preinstall and postinstall lifecycle scripts that run inline Node code targeting the AWS EC2 Instance Metadata Service. T...

MAL-2026-13978 Malicious code in datefmt-util-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d897db063e1782ce6549adbac0736b75a2708f864c8eacfeaabac56b76c1bcbb Package presents itself as a date-formatting utility but ships a postinstall reverse shell. package.json declares scripts.postinstall = 'node...

Malicious code in @khaznatech/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59ac302f60b532a4e864c576593db300a20abba96ae2a53ba5da0cc06d8dc911 The package's preinstall script install-report.js runs automatically on npm install and performs an HTTPS GET to a hardcoded webhook.site capture...

MAL-2026-13973 Malicious code in @khaznatech/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59ac302f60b532a4e864c576593db300a20abba96ae2a53ba5da0cc06d8dc911 The package's preinstall script install-report.js runs automatically on npm install and performs an HTTPS GET to a hardcoded webhook.site capture...

Malicious code in @khaznatech/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d6d321090b3f66b7766ca73a5cebf1a2d3ab2908d8d31f8423616c8094ec0a8 The package declares a preinstall script install-report.js that runs on npm install. It reads os.hostname and the current working directory basename...

MAL-2026-13975 Malicious code in @khaznatech/utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d6d321090b3f66b7766ca73a5cebf1a2d3ab2908d8d31f8423616c8094ec0a8 The package declares a preinstall script install-report.js that runs on npm install. It reads os.hostname and the current working directory basename...

Malicious code in @khaznatech/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 820c7f4f32895ef501e6926f624897cf41b5f868bc21c60852cbfc101b4cd5ba The package ships install-report.js as a preinstall lifecycle script that unconditionally runs on npm install. The script reads os.hostname and the...

MAL-2026-13974 Malicious code in @khaznatech/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 820c7f4f32895ef501e6926f624897cf41b5f868bc21c60852cbfc101b4cd5ba The package ships install-report.js as a preinstall lifecycle script that unconditionally runs on npm install. The script reads os.hostname and the...

Malicious code in cspell-esm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e857800f57969e257ed22cd056f2e4a4395de09ac9b69becd0c7c2b931314ab Package name resembles the widely-used 'cspell' library but its main entry index.js exports an empty object and provides no functionality. Its...

Malicious code in resolve-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86b902b4dc4c2187bb95548ed903dfea70ea626ba5450f031c2cb27b3639dd1c [email protected] is a stub package index exports an empty object whose package.json declares its only dependency ltidisafe as a direct HTTPS...