CVE-2026-44955 Exposure of Sensitive System Information to an Unauthorized Control Sphere in Panduit IntraVUE by Pronetiqs

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could allow for asset discovery by unauthenticated users...

PT-2026-64198

Name of the Vulnerable Software and Affected Versions Pronetiqs IntraVUE versions 3.2.1a14 and earlier Description An exposure of sensitive system information to an unauthorized control sphere allows unauthenticated users to perform asset discovery. Recommendations Update Pronetiqs IntraVUE to a...

PT-2026-64195

Name of the Vulnerable Software and Affected Versions Pronetiqs IntraVUE versions prior to 3.2.1a14 Description An exposure of sensitive system information to an unauthorized control sphere exists, which could lead to the exposure of the underlying host or share filesystem. Recommendations Update...

CVE-2026-44878

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete syste...

MAL-2026-10683 Malicious code in formatters.ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21827129edc8dbde114c615df656d5a234d1fbcfa5b9f63d5286d781253e8f2b The package declares a preinstall hook that runs index.js on npm install. index.js collects host and identity reconnaissance — os.hostname,...

CVE-2026-61975

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetReviews jet-reviews allows Retrieve Embedded Sensitive Data.This issue affects JetReviews: from n/a through = 3.0.1...

Malicious code in conversionvaluemanager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21445a74cc1c4d33c89f1a7d8c357c79d5adb11cda135c813676b23c875418e9 On npm install, postinstall.js automatically runs and gathers installer-identifying data os.hostname, os.userInfo, os.platform, cwd, Node version,...

MAL-2026-10019 Malicious code in client-cookies-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12870ae203f2612ab2bf9e796583acba17914cd4699909156f86c643fcf51f24 package.json declares postinstall=node index.js, which runs automatically on npm install. index.js collects host identifiers via os.hostname,...

HTML injection in Diagram tab and Graph view in Guardian/CMC before 26.2.0

Summary A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restrictive. Impact An authenticated user with administrative privileges can inject malicious HTML tags into N2OS configuration data throug...

MAL-2026-6561 Malicious code in skillspector (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c77584b4e40db9023ca0b8a90fa1bd611c859ed486f99ca3a7c9a83dbfa9877 This package presents itself as a redistribution of NVIDIA/skillspector pyproject Homepage points to github.com/NVIDIA/skillspector and the source...

MAL-2026-6238 Malicious code in atlasora-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbd4392d81da887d2d7da24519df3a7d9341ee45e1fc091a724c4f5ede766ae5 package.json declares "postinstall": "node install.js", which runs automatically on npm install. install.js requires https, fs, os, and childprocess;...

Malicious code in @public-for-cdao/abi (npm)

The @public-for-cdao/abi package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

MAL-2026-10599 Malicious code in @public-for-cdao/abi (npm)

The @public-for-cdao/abi package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

Malicious code in @public-for-cdao/api (npm)

The @public-for-cdao/api package is part of a dependency-confusion credential theft campaign. Its package.json declares a postinstall hook that runs node recon.js automatically during npm installation. The bundled recon.js is identical across six packages in the @public-for-cdao scope and has...

MAL-2026-5863 Malicious code in @ts-internal/shared-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7afc836ea4b9ecc7e09f0add976470f1b4e253f8b5b53b3ce706889efb349171 The package squats the internal-looking scope @ts-internal/shared-lib on the public npm registry and runs a network beacon both during install...

Malicious code in oh-my-ashclaw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector daf0a5a6234cbf55718057017cbe143ab41ad1aaf7964ebfaab6dfe12703b005 On npm install, the package's postinstall hook .prepare.cjs executes and harvests installer-side data: hostname, username, OS/arch, Node version, all...

MAL-2026-5561 Malicious code in @bestlzk/sectest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cfce552ac72417ec7db2c48e0e13b1d060007167e82bd0f9b10799efe85e7f4 On npm install, postinstall.js collects platform, Node version, current working directory, and OS username, then POSTs them as JSON to...

MAL-2026-5518 Malicious code in hello-dynamic (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1532f25a13ed2c77496e590acadc24df4fa7d063e707c53687143a7457e2d2e hello-dynamic 0.1.2 is a near-empty package whose init.py only defines a hello function printing 'Hello!'. Its setup.cfg declares a dependencylinks...

CVE-2025-62851

A path traversal vulnerability has been reported to affect License Center. If a local attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: License...

CVE-2025-62851

The issue is CVE-2025-62851 affecting License Center. A path traversal vulnerability exists when an attacker who already has an administrator account can read contents of unexpected files or system data. The vulnerability details indicate exploitation requires administrator privileges and does no...