CVE-2026-114515

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job...

CVE-2026-114515

Prior to version 1.2.3 , OCO-Server (an endpoint management application) is vulnerable to an authorization bypass that allows a Self-Service Portal user to queue unauthorized software-removal jobs. The root cause is located in lib/SelfService/CoreLogic.class.php::uninstallSelfService(), where a p...

CVE-2026-114515 OCO-Server: Self-Service Portal uninstall-job authorization bypass

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job...

EUVD-2026-108210

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job...

Malicious code in ui-weave (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee5b1184b3208f8eee80df74c37c809f93461564a9226e1f82e1d551770d799a package.json declares postinstall: node lib/utils/index.js, which spawns a detached child process running lib/utils/smtp-connection/index.js. That...

MAL-2025-48967 Malicious code in @gitlab-test/pnpm-v9 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 352b39cbb73b3231bb6a6698230853fb58dd0313c7187e98a39dba4502226b02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2020-2222

Malware in sbrugna...

EUVD-2016-2788

Malware in sbrugna...

EUVD-2015-2511

Malware in sbrugna...

EUVD-2023-58498

Malicious code in bioql PyPI...

EUVD-2023-25892

Malicious code in bioql PyPI...

MAL-2025-6388 Malicious code in dhei-0731-pkg2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe8d7b6c360cad159d0e612206bf57a2317fd56b354a52d680325314989891c6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6358 Malicious code in @video-platform/react-osd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1da44cdfe8c5208f12300bf0c4c194e63b2c04b4bd437c4dc12886e9a2e8169 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6355 Malicious code in @sme-configs/karma-coverage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 650b31b0f3209c6ac44a7187c6a39bf6f634660ded19dc4dffd69f7f906dc285 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6376 Malicious code in vite-log-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e278049c2919582d9fdb72033c214b715cd3cf34a0a80051a894185c4f669207 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6375 Malicious code in vanilla-cacher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a170174d56e5363e8c8a3d47eb94f80f3b3dc18a2bf2240e372730ffe076ca97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6374 Malicious code in stream-loggers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c02793265c4ba517b0a8883b03a45f3e045877b20c4abbcf4b27999bce7b68de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6373 Malicious code in redux-eslint-saga (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d08211092766c0313df71f1e2fe6fa8cf606e4f36570679a1391bda0a5dfd6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6372 Malicious code in real-socket-rt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 897bfab5a2a7a305ab43ec0ffd356a56000463ad0f0c9c77731d1aa197aca121 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6370 Malicious code in react-icon-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46dc16e0765ddb06bcc46c49b58deba17ff9d4fce6cc5b65ebba0f617cf44fed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...