IngEstate Server 安全漏洞

IngEstate Server is a real estate asset management and information service platform developed by IngEstate Server Inc. IngEstate Server v11.14.0 contains a security vulnerability. This vulnerability stems from an editing function on the software package list page that allows for stored cross-site...

CVE-2026-30082

IngEstate Server v11.14.0 is vulnerable to multiple stored cross-site scripting (XSS) vulnerabilities within the Edit feature of the Software Package List page. The root cause is the improper neutralization of input, specifically via the About application , What's news , or Release note parameter...

CVE-2026-30082

Multiple stored cross-site scripting XSS vulnerabilities in the Edit feature of the Software Package List page of IngEstate Server v11.14.0 allow attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the About application, What's news, or Release note parameters...

CVE-2026-34387 Fleet vulnerable to OS command injection via crafted software package metadata in uninstall scripts

Fleet is open source device management software. Prior to 4.81.1, a command injection vulnerability in Fleet's software installer pipeline allows an attacker to achieve arbitrary code execution as root macOS/Linux or SYSTEM Windows on managed hosts when an uninstall is triggered for a crafted...

Malicious code in nodecognivault (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7709482c6e8d04dee2a9310780eff8f0f31cb64800273088f08a5cd1a8570c0a The package nodecognivault was found to contain malicious code...

MAL-2026-2359 Malicious code in env-embed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb6e9ae149bf8b69194b4ae8fea78a4f31cbd1c01a9f65a188c063380b5c1d34 The package env-embed was found to contain malicious code...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised as the result of Trivy's GitHub Actions compromise and a malicious versions were released on NPM. They contain malicious code, and its content was NOT yet...

SUSE: Security Advisory (SUSE-SU-2026:20581-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OPENSUSE-SU-2026:10150-1 cockpit-subscriptions-14.4-2.1 on GA media

These are all security issues fixed in the cockpit-subscriptions-14.4-2.1 package on the GA media of openSUSE Tumbleweed...

Malicious code in z-shop-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ac6f0b86a348586f517ef591a8fa3dd2ffffd919bcc1f6cfce912d06cba4aa5 The package z-shop-ui was found to contain malicious code. Source: ghsa-malware 7d3e42fd3ceecf78bbc9a794a0a36c38485ab8e91fe9892ffbd9c1db7f2a0fa0 Any...

Malicious code in hultine (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c6e91ab35953cced9cf886a16976bb282de1dcf804938f4179a2dcf8dc1af731 Package exploits dependency confusion. A beacon request is used to report usage back, but no additional information are exfiltrated. --- Category:...

MAL-2026-478 Malicious code in domino-elements (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d29d322166d012b639664f1711c5c9ca4353508a8ffa2e48eb5b7b14bbda296 The package domino-elements was found to contain malicious code...

Malicious code in integromat-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7de4e86762c4fcb7682615925818028501cfb55cdd9fdeaf238f2e186b1f121e The package integromat-ui was found to contain malicious code...

Malicious code in presentation-test-utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b481e6b9e82f740ebadaad84b281196fae93b52b14c302f7763234319c732f3e The package presentation-test-utilities was found to contain malicious code. Source: ghsa-malware...

MAL-2026-313 Malicious code in spire.officejs-fonts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85e04f3e2745bb2e3fd9eac19b0b9c45ad94c1ead97c8a9a4a1db6d412bd39eb The package spire.officejs-fonts was found to contain malicious code...

Malicious code in @ux-foundry/palette (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddd18fdf82036fc2f39aba4198fb081eb4cb5683f9b9308bdb2a0f8539c54275 The package @ux-foundry/palette was found to contain malicious code. Source: ghsa-malware...

Malicious code in cognito-auth-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9a30b64637eafca16b5e2eba32def6f026de37b2e2085a66aa627c5bfe9403d The package cognito-auth-plugin was found to contain malicious code. Source: ghsa-malware...

OPENSUSE-SU-2026:10043-1 python311-filelock-3.20.3-1.1 on GA media

These are all security issues fixed in the python311-filelock-3.20.3-1.1 package on the GA media of openSUSE Tumbleweed...

MAL-2026-14 Malicious code in ent-profile-unauth-msr-stop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cccedcc6e7e3c24d5bf3abeb2d093bb12520a9973d6aaf7874d6559127e947c The package ent-profile-unauth-msr-stop was found to contain malicious code. Source: ghsa-malware...

CVE-2025-67450

Due to insecure library loading in the Eaton UPS Companion software executable, an attacker with access to the software package could perform arbitrary code execution . This security issue has been fixed in the latest version of EUC which is available on the Eaton download center...