MAL-2026-4614 Malicious code in moneykit-cardano-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6186e5ec8b6cea4f1cec3b4284cf09f2e317dd7d745fb5f88e15b355497d08e package.json declares preinstall: node index.js, which fires automatically on npm install. index.js collects host identifiers and OS files —...

PT-2026-42441

Name of the Vulnerable Software and Affected Versions Honeywell Control Network Module CNM affected versions not specified Description The software allows the insertion of sensitive information into an unintended directory. An attacker could exploit this issue by probing system files, which may...

PT-2026-42658

Name of the Vulnerable Software and Affected Versions UniFi OS affected versions not specified Description A Path Traversal vulnerability exists in UniFi OS devices due to improper restriction of directory path names. A malicious actor with network access can exploit this issue to access files on...

CVE-2026-35593 Trilium Notes has Local File Inclusion via upload modified file API endpoint

Trilium Notes is an open-source, cross-platform hierarchical note taking application for building large personal knowledge bases. Versions 0.102.1 and prior are vulnerable to Local File Inclusion, allowing an authenticated attacker to read sensitive arbitrary files from the server's filesystem. T...

CVE-2021-47978 ProcessMaker 3.5.4 Local File Inclusion via Path Traversal

ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path traversal validation. Attackers can send requests with directory traversal sequences to access sensitive system files like /etc/passwd without...

EUVD-2026-30049

The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. Prior to 1.3834.0, the CoworkVMService component in Claude Desktop for Windows ran as SYSTEM and did not validate whether the VM bundle directory was a real directory or an NT...

CVE-2020-37219

Joomla extension com_fabrik 3.9.11 contains a directory traversal vulnerability in image.php that lets unauthenticated attackers enumerate arbitrary files. By manipulating the folder parameter in onAjax_files, attackers can use path traversal sequences to list files in system directories outside ...

Claude Code 后置链接漏洞

Claude Code is an open-source terminal-native AI programming tool developed by Anthropic. Versions of Claude Code prior to 1.3834.0 contained a post-installation vulnerability. This vulnerability stemmed from the CoworkVMService component running with SYSTEM privileges and without verifying wheth...

Plasma Workspace 安全漏洞

Plasma Workspace is an open-source application developed by the KDE GitHub Mirror project. It serves to run various components required for a Plasma-based environment. Plasma Workspace has a security vulnerability that stems from multiple issues, which may allow an infected plasmalogin service...

PT-2026-40383

A vulnerability exists in the web-based management interface of an AOS-10 Gateway that could allow an authenticated remote attacker to access sensitive files on the underlying operating system. Successful exploitation of this vulnerability could result in the disclosure of confidential system...

Nessus Manager < 10.10.3 / 10.11.0 < 10.11.3 Path Traversal (TNS-2026-08)

According to its self-reported version, the Nessus Manager application running on the remote host is prior to 10.10.3, prior to 10.11.3. It is, therefore, affected by an path traversal vulnerability as referenced in the TNS-2026-08 advisory. - A path traversal vulnerability exists in Nessus Manag...

CVE-2022-50992

Weaver E-cology 9.5 (pre-10.52) is affected by an unauthenticated arbitrary file read via the XmlRpcServlet at the XML-RPC endpoint. The vulnerability arises in WorkflowService.getAttachment and WorkflowService.LoadTemplateProp, allowing remote attackers to read arbitrary files (including system ...

EUVD-2018-21832

VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows authenticated attackers to disclose arbitrary files by injecting path traversal sequences in the ID parameter. Attackers can submit requests to downloadsys.pl, downloadxml.pl,...

CVE-2018-25311

VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers with valid credentials to disclose arbitrary files by injecting path traversal sequences in the ID parameter. Attackers can submit requests to downloadsys.pl,...

PT-2026-35994

VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows authenticated attackers to disclose arbitrary files by injecting path traversal sequences in the ID parameter. Attackers can submit requests to downloadsys.pl, download xml.pl,...

GHSA-V24V-F45G-W7JF Duplicate Advisory: uutils coreutils has a Time-of-Check to Time-of-Use (TOCTOU) race condition

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-239g-2685-54x3. This link is maintained to preserve external references. Original Description The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use TOCTOU race condition during...

uutils coreutils 安全漏洞

uutils coreutils is a cross-platform core command-line toolset developed by Uutils. There is a security vulnerability in uutils coreutils, which stems from a race condition during the installation process of the install file. This vulnerability could allow local attackers to redirect privileged...

PT-2026-34195

Name of the Vulnerable Software and Affected Versions Hermes WebUI affected versions not specified Description An arbitrary file deletion issue exists in the '/api/session/delete' endpoint. Authenticated attackers can delete files outside the session directory by providing an absolute path or pat...

EUVD-2026-23167

MailGates/MailAudit developed by Openfind has a CRLF Injection vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read system files...

CVE-2026-6351

CVE-2026-6351 concerns Openfind’s MailGates/MailAudit. The Connected CVE record states a CRLF Injection vulnerability that enables unauthenticated remote attackers to read system files. This describes the vulnerable surface as the MailGates/MailAudit components, with exploitation possible without...