MAL-2026-11095 Malicious code in @array-util/subsearch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793344e3c658f3649a113e29dd1124d979af9a7978f3159c55f8da6f6b3bc918 The package's index.js is heavily obfuscated string-array shift/rotate pattern with hex-encoded indices and a while!! decoder loop. Obfuscation in a...

CVE-2026-66053

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603...

Malicious code in amanexzyra-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95c2dc37b7d123a5de5b204c909ddc35474421dc3e0e7a4f256691a54d825c20 Package name amanexzyra-baileys resembles the popular WhatsApp Web API library @whiskeysockets/baileys family, which has been a frequent target of...

PT-2026-65307

Name of the Vulnerable Software and Affected Versions Quest KACE Systems Deployment Appliance SMA version 11.0.273 Description The software installs with default user credentials for the report and R1 MySQL accounts, using the publicly known password box747. This allows remote attackers to gain...

CVE-2026-16043

QEMU xHCI Interrupter Register OOB Access Non-Default Configuration...

PT-2026-65043

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, OpenBao's TOTP secrets engine could accept valid codes multiple times rather than strictly-once. This was caused by unexpected...

CVE-2021-32088: Session Fixation

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie...

CVE-2021-32085: Use of Hard-coded Credentials

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It installs with default user credentials. The report and R1 MySQL accounts have a password of box747, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the...

CVE-2021-32088

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. Certain API endpoints contain a rate-limiting feature to minimize a brute-force attack. This protection can be bypassed by removing the kboxid cookie...

CVE-2021-32084

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API,...

PT-2026-65129

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Sequoia versions prior to 15.7.8 macOS Sonoma versions prior to 14.8.8 macOS Tahoe versions prior to 26.6 watchOS versions prior to 26.6 Description An integer overflow occurs due ...

Siemens SIMATIC S7-1500 CPU 1518 MFP Incomplete Cleanup (CVE-2026-43027)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505870; scriptversion"1.4"; scriptsetattributeattribute:"pluginmodificationdate",...

PT-2026-65275

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Tahoe versions prior to 26.6 tvOS versions prior to 26.6 visionOS versions prior to 26.6 watchOS versions prior to 26.6 Description An authorization issue exists due to improper...

CVE-2021-32084

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API,...

Linux Distros Unpatched Vulnerability : CVE-2026-60177

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Clone Plugin. Supported versions that are affected are MySQL Server:...

PT-2026-65207

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.6 iPadOS versions prior to 26.6 macOS Tahoe versions prior to 26.6 tvOS versions prior to 26.6 visionOS versions prior to 26.6 watchOS versions prior to 26.6 Description An out-of-bounds read occurs due to insufficient...

CVE-2021-32084: Improper Access Control

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API,...

CVE-2021-32086

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It uses a hardcoded symmetric encryption key to encrypt secrets in the MySQL databases. This key is not unique for each installation. An attacker that gains access to the MySQL server or a backup files can decrypt th...

CVE-2021-32088

The Quest KACE Systems Deployment Appliance (SMA) 11.0.273 is vulnerable to a rate-limiting bypass. Specifically, certain API endpoints include a feature designed to mitigate brute-force attacks, but this protection can be circumvented by removing the kboxid cookie . Exploitation details and spec...

CVE-2021-32087

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service...