MAL-2026-4359 Malicious code in @agora-sdk/react-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9febb9d8dda2eea07ef909b9713ca6531c4a5b51a75fd730a312bec8d8a11135 Package is published under the '@agora-sdk' scope, strongly associated with Agora.io's real-time-communications SDKs, but its actual contents are a...

CLSA-2026-1779694887 rsync: Fix of CVE-2026-29518

CVE-2026-29518: fix daemon-no-chroot TOCTOU symlink race by tracking per-module chroot in amchrooted, routing sender read-path, receiver basis-file open, mkstemp, and inplace write through securerelativeopen / securemkstemp...

CLSA-2026-1779694727 Fix CVE(s): CVE-2026-29518

SECURITY UPDATE: daemon-no-chroot TOCTOU symlink race - debian/patches/CVE-2026-29518.patch: track per-module chroot in amchrooted and usesecuresymlinks; route the sender's read-path open, the receiver's basis-file open, mkstemp, and inplace write through securerelativeopen / securemkstemp -...

CVE-2026-40016

A flaw was found in Dovecot. A remote or local attacker could upload a malicious Sieve script through the ManageSieve service, or locally, to bypass configured CPU time limits for Sieve scripts. This allows the attacker to consume excessive server resources, leading to a degradation of server...

Edimax EW-7438RPn 安全漏洞

Edimax EW-7438RPn is a wireless signal extender from Taiwan, China-based Edimax. A security vulnerability exists in the Edimax EW-7438RPn version 1.31, which originates in the parameter maxConn/timeOut operation of the function formConnectionSetting in the file /goform/formConnectionSetting, and...

PT-2026-43221

Visual Ping 0.8.0.0 contains a buffer overflow vulnerability in input field handling that allows local attackers to crash the application by supplying oversized data. Attackers can inject malicious payloads exceeding 4108 bytes into the Host, Time Out, Packet Size, Pause, or Loops fields to trigg...

PT-2026-43231

Name of the Vulnerable Software and Affected Versions Collectric CMU version 1.0 Description An issue exists where unauthenticated attackers can manipulate database queries during authentication. This is achieved by injecting SQL code through the lang parameter in login requests, allowing the...

Intelligent Detection and Mitigation of Carpet-Bombing DDoS Attacks in SDN Using Retrieval-Augmented Generation and Large Language Models

Software-Defined Networking SDN provides flexible and programmable network management; however, its centralized control architecture remains highly vulnerable to Distributed Denial-of-Service DDoS attacks, particularly Carpet-Bombing DDoS attacks that distribute malicious traffic across multiple...

Collectric CMU SQL注入漏洞

The Collectric CMU is a smart meter device from Collectric in the Netherlands that supports power metering with supporting communication extensions. A SQL injection vulnerability exists in Collectric CMU version 1.0, which stems from the presence of Boolean-based blind SQL injection in the lang...

Fedora 44 : chromium (2026-c758d44a9a)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c758d44a9a advisory. Update to 148.0.7778.178 CVE-2026-9111: Use after free in WebRTC CVE-2026-9110: Inappropriate implementation in UI CVE-2026-9112: Use after free in...

Alibaba Cloud Linux 3 : 0127: PackageKit (ALINUX3-SA-2026:0127)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0127 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-41651: PackageKit is a a D-Bus abstraction...

Exploit for SQL Injection in Cmsmadesimple Cms_Made_Simple

CMS Made Simple CVE-2019-9053 Exploit Python 3 Python 3 com...

MAL-2026-4776 Malicious code in whatsfly-labfox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c63e3f4776abe00db50f3d7e34bea3ed308a52b6e0c44872692b0dce50290d1f On import whatsfly, whatsfly/init.py invokes ensureUsableBinaries from whatsfly/dependencies/builder.py, which downloads a native binary...

Malicious code in whatsfly-labfox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c63e3f4776abe00db50f3d7e34bea3ed308a52b6e0c44872692b0dce50290d1f On import whatsfly, whatsfly/init.py invokes ensureUsableBinaries from whatsfly/dependencies/builder.py, which downloads a native binary...

FortressWAF

FortressWAF — Web Application Firewall !Licensehttps://im...

CVE-2026-9362

CVE-2026-9362: Edimax EW-7438RPn firmware 1.12 has a command-injection in the Setting Handler’s formConnectionSetting (/goform/formConnectionSetting). Manipulating max_Conn/timeOut parameters can lead to remote execution. Attack vector is network with low complexity; authentication required is LO...

MAL-2026-4577 Malicious code in harness-skil (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e03ab8467953cd2233e07e792a33c7df7be2c99c66da3b814538a169337b93e6 The package's install.js wired to an npm install lifecycle hook requires childprocess, fs, and https, then issues an https.get to a...

unbound: Unbound: Cache manipulation via 'ghost domain names' attack

A flaw was found in NLnet Labs Unbound. A remote attacker, by controlling a malicious domain a "ghost zone" and querying a vulnerable Unbound server, could exploit a vulnerability related to "ghost domain names" attacks. This could allow the attacker to overwrite cached Name Server NS records,...

CVE-2018-25342

Smartshop 1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'searched' parameter in search.php. Attackers can send GET requests with malicious SQL payloads like SLEEP commands to extract...

EUVD-2018-21864

Smartshop 1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'searched' parameter in search.php. Attackers can send GET requests with malicious SQL payloads like SLEEP commands to extract...