ZimaOS <= v1.2.4 - Sensitive Information Disclosure

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as http:///v1/users/image?path=/var/lib/casaos/1/apporder.json and http:///v1/users/image?path=/var/lib/casaos/1/system.json,...

CVE-2026-28698 Exposure of Sensitive System Information to an Unauthorized Control Sphere in Panduit IntraVUE by Pronetiqs

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could expose the underlying host/share filesystem...

CVE-2026-28698

CVE-2026-28698 affects Pronetiqs IntraVUE prior to or equal to version 3.2.1a14. The vulnerability exposes sensitive system information to an unauthorized control sphere, potentially exposing the underlying host/share filesystem. The CVSS data indicates high to critical impact (CVSS 3.1: HIGH, CV...

MAL-2026-10936 Malicious code in twilio-platform-request (npm)

The twilio-platform-request package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a private...

DEBIAN-CVE-2026-50289

systeminformation is a System and OS information library for node.js. Prior to 5.31.7, networkInterfaces on Linux is vulnerable to OS command injection through the Debian/Ubuntu interfaces5 source directive because lib/network.js checkLinuxDCHPInterfaces reads /etc/network/interfaces, extracts a...

MAL-2026-10632 Malicious code in cppt-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 484688d5963a9246f4fe7a2b5c1c7ebe6bba135a2a5df66b3ab57f44978407b2 [email protected] declares a preinstall hook "preinstall": "node index.js" that runs automatically on npm install. index.js collects host and user...

MAL-2026-10588 Malicious code in momenntjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aae445dd0b77bd7409820067097404e4ccb16d658e7911c7c4e659146fdfad4 momenntjs is a typosquat of momentjs whose package.json postinstall hook runs node.init.js. On npm install,.init.js enumerates roughly 60...

Windows Kernel Information Disclosure Vulnerability

Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose information locally...

MAL-2026-10579 Malicious code in bimi-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a4e6202887cfa87e6dcff6e37af854445a0e44f38b25ef6d3e40fec06cc8b5f On npm install, the package's preinstall hook runs node index.js, which executes whoami and id via childprocess and collects os.hostname, os.userInfo...

Malicious code in eslint-angular-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9a6248527167bc121cdf2c1a874adbc9d433dbe4be2aed160e8abb3eb2ca63b package.json declares a preinstall lifecycle script that runs curl against the hardcoded bare IP http://109.71.252.153:8080/ at npm install time,...

MAL-2026-10478 Malicious code in @sectest429/hello-npm-world (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 479b9303d76a49dfacb402f0a906e32686b5d276e23f429678150e73e506550d The package advertises a single function module.exports = function helloname but ships a preinstall.js lifecycle script that runs automatically on np...

Malicious code in @sectest429/hello-npm-world (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 479b9303d76a49dfacb402f0a906e32686b5d276e23f429678150e73e506550d The package advertises a single function module.exports = function helloname but ships a preinstall.js lifecycle script that runs automatically on np...

PYSEC-2026-2623 mcp-memory-service Vulnerable to System Information Disclosure via Health Endpoint

Summary The /api/health/detailed endpoint returns detailed system information including OS version, Python version, CPU count, memory totals, disk usage, and the full database filesystem path. When MCPALLOWANONYMOUSACCESS=true is set required for the HTTP server to function without OAuth/API key,...

MAL-2026-10425 Malicious code in trinity-scheme (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d576c0487668f599137a479e17ddc1335935fdec631f7d5adfa9e73049d7652 On npm install, the package's preinstall lifecycle reads a hex-encoded command string from preinstall.json, decodes it via Buffer.from..., 'hex', and...

MAL-2026-10207 Malicious code in react-dom-v17 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f55f6e35ab09a2fcd6521dac51aa4baa4cfa726958bc266a0d56fc14de240a29 Package name impersonates the widely-used react-dom package react-dom-v17. package.json declares preinstall: node index.js, which fires automatically...

MAL-2026-10205 Malicious code in library-explorer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28b5db05b3bdfb9cc8b1af9759f05a3bc7a1b6a9c364b86831b93df78e9e2273 package.json declares preinstall: node index.js. On npm install, index.js collects installer host identity os.hostname, os.platform, os.arch,...

MAL-2026-10200 Malicious code in api-changelly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a94f4aa368f1838507a78dde78062b740a5853b516d9d32782d0264b539b724c The package declares preinstall: node index.js, which runs automatically on npm install. index.js collects installer identifiers os.hostname,...

MAL-2026-10186 Malicious code in google-caja-bower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e34339f1be6afb8a41b6dbe2f7d7c480d5a438a67ff119b235d1d98ffa2b2e4a [email protected] declares scripts.preinstall = 'node index.js', so index.js runs automatically on npm install. index.js walks the...

Malicious code in auth-next-gen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe0926f0a2c1f47072efaac014be38bb00c8e9f31f59badf188b1ed74dd5c2ce On require of auth-next-gen, index.js loads lib/writer.js, which at module top level performs an axios GET against a base64-obfuscated URL...

Malicious code in dependency_confusions (npm)

The npm package dependencyconfusions version 99.9.9 performs install-time host fingerprint and project path exfiltration. package.json sets index.js as the package main entrypoint and defines postinstall: node index.js. During npm install, index.js builds a JSON payload containing the local...