ZimaOS <= v1.2.4 - Sensitive Information Disclosure

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as http:///v1/users/image?path=/var/lib/casaos/1/apporder.json and http:///v1/users/image?path=/var/lib/casaos/1/system.json,...

aura-botnet

Aura Botnet C2 Server The botnet's C2 server utilizes the Django framework as the backend. It is far from the most efficient web server, but this is offset by the following: Django is extremely portable and therefore good for testing/educational purposes. The server and database are contained...

EUVD-2026-70917

XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere CWE-497. Sensitive system information may be leaked...

CVE-2026-66840

XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere CWE-497. Sensitive system information may be leaked...

CVE-2026-66840

XING CPTrans-ME-X , a rack accessory product, is affected by an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) , which may allow sensitive system information to be leaked. The vulnerability is exploitable over the network with low complexity , requires no pri...

UBUNTU-CVE-2026-55584

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

CVE-2026-55584 phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

CVE-2026-55584

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

CVE-2026-55584 phpSysInfo: IP allowlist (PSI_ALLOWED) bypass via spoofed X-Forwarded-For / Client-IP headers

phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSIALLOWED access-control check in readconfig.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTEADDR. A remote unauthenticated attacker can supply an allowed address ...

Malicious code in remove-bg-serverless-azure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcbce8344eb0762c4a9ef029743efe13045422b839444b828c245a09a85fc74e package.json declares preinstall: node index.js, so npm install automatically runs index.js. index.js reads os.hostname, os.userInfo, the user home...

MAL-2026-12669 Malicious code in dbk-ui-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36c6972ca0999559f2a4548843790c8000451acb4869da3c83d0357a655586ba On npm install, the package's preinstall hook runs index.js which collects host identity hostname, username, homedir, network interfaces, uid, output...

Malicious code in clover-codelab-remote-pay-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 071fbdd6b5ca7cbb0fc696f5abf7a47be3783dd970ca5594cb415e67579f2b15 The package declares a postinstall hook that runs index.js on npm install. index.js collects the OS username, current working directory, hostname, an...

MAL-2026-12353 Malicious code in clover-codelab-remote-pay-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 071fbdd6b5ca7cbb0fc696f5abf7a47be3783dd970ca5594cb415e67579f2b15 The package declares a postinstall hook that runs index.js on npm install. index.js collects the OS username, current working directory, hostname, an...

Malicious code in crypto-javas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75003e4aab1668c5d9b7f1216e6b356473ebb6e834da3a015e920807e8717ed9 The package's postinstall hook runs setup.js, which enumerates process.env excluding only a small OS blocklist for PATH/HOME/USER/SHELL/LANG, collect...

MAL-2026-12386 Malicious code in fundraiserservpp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bca913238607a18079a675e2fe652c25c04c2bbc62f5c577bb2b6d2424cd4a8 [email protected] runs node index.js as a preinstall lifecycle script on npm install. The script collects host metadata from the installer machi...

Malicious code in vscode-designer-14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcf384e12e957c8d6b3d0014504f652cd2b6f3885f49820a2907865566bb6137 package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's hostname, username, home directory, DNS...

Malicious code in new-native-tools-linux-x64-gnu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b38b165a8872e9c65dab5b230d8a4cc26e045f5fc3fd8502fd711652913af44a The package ships a single 10 MB Rust-compiled Linux x8664 N-API native module tools.linux-x64-gnu.node referenced by main, with a two-line README th...

MAL-2026-12483 Malicious code in tracker-radar-detector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 570031a196f05126b79c16e2910bc5c1c8c1534821e9b65231303b1bb5cd54e1 package.json declares a preinstall hook that runs index.js on npm install. The script collects the machine's hostname, OS username, home directory, D...

MAL-2026-11200 Malicious code in ml-fdbk-shared (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2f2313f59d10884a764cb2e2dbfe3aa8ae97545c995785f65ca1e856b4a29b8c During installation, package exfiltrates basic info and all environmental variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-11135 Malicious code in ethers-secure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa36b9a8ec228142a26760738fbbca9c72f9634ed0abedb9d5beeae6a2441244 Package name mimics the popular ethers library. Its exported wallet API WalletClient/createWalletClient/parseAccount accepts an Ethereum private key...