Malicious code in @drone-js-ext/vip-badge (npm)

Source: amazon-inspector 2f7afa65da63d3360d15659ebdcce5f5078fa7bd210e04c069f88834f0c1f75c The package is a zero-functionality stub whose main module index.js exports a Proxy returning no-op functions for any property access. Its only real behavior is a beacon implemented in beacon.cjs that collec...

CVE-2026-36438

CVE-2026-36438: Sensitive information via password reset The Intelbras VIP 1230 B/D G4 versions prior to 6 allows a remote attacker to obtain sensitive information of administrator account via password reset functionality under OutsideCmd file. Discovered by Henrique Koji, Feb 2026. References:...

MAL-2026-18277 Malicious code in @drone-js-ext/vip-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f7afa65da63d3360d15659ebdcce5f5078fa7bd210e04c069f88834f0c1f75c The package is a zero-functionality stub whose main module index.js exports a Proxy returning no-op functions for any property access. Its only real...

Malicious code in @drone-js-ext/vip-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 914f57c3481f23f4682ff7bdd7b9849865531023c6d547ed76d42e9da6bbd8dc @drone-js-ext/vip-badge is a functionless stub whose only behavior is a phone-home beacon. The package.json postinstall script runs node beacon.cjs,...

CVE-2018-4878-

-cms Server cluster batch identification of cms, batch backup search, batch injection. VIP group version backup...

CVE-2026-81870 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

CVE-2026-81870 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11. A patched version of the package is available...

CVE-2026-97032 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

CVE-2026-97032 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11. A patched version of the package is available...

CVE-2026-78660 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

CVE-2026-78660 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11. A patched version of the package is available...

CVE-2026-78659 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

CVE-2026-78659 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11. A patched version of the package is available...

CVE-2026-78663 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

CVE-2026-78663 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11. A patched version of the package is available...

CVE-2026-78669 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11

CVE-2026-78669 affecting package kube-vip-cloud-provider for versions less than 0.0.10-11. A patched version of the package is available...

AZL-107622 CVE-2026-97032 affecting package kube-vip-cloud-provider 0.0.10-10

HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the...

AZL-107631 CVE-2026-78669 affecting package kube-vip-cloud-provider 0.0.10-10

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGSINITIALWINDOWSIZE values...

AZL-107625 CVE-2026-78660 affecting package kube-vip-cloud-provider 0.0.10-10

Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a...

AZL-107628 CVE-2026-78663 affecting package kube-vip-cloud-provider 0.0.10-10

The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream refunding data for any sent-but-unread portion of the stream, and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configur...

AZL-107619 CVE-2026-78659 affecting package kube-vip-cloud-provider 0.0.10-10

When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending ...

CVE-2026-80276

Comelit Multi-User Gateway for VIP System model 1456B firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not require authentication. Through this interface, sensitive device configuration data - including the Remote Configuration Password - can be read i...

CVE-2026-80275

Comelit Multi-User Gateway for VIP System model 1456B firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer administrator account password...

EUVD-2026-90504

Comelit Multi-User Gateway for VIP System model 1456B firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer administrator account password...

CVE-2026-80275

The Comelit Multi-User Gateway for VIP System (model 1456B) is vulnerable in firmware versions 2.9.1 and 2.10.0 due to a failure to enforce server-side authorization on an administrative password-change function. This flaw allows an authenticated user level to invoke the function and overwrite th...