MAL-2026-16480 Malicious code in a-onesite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b1ed6ca931448c083b5356eae6ad5af3cce9011d70fce4ce4ad427349991856 [email protected] ships an empty index.js and no library functionality. Its package.json declares preinstall, preupdate, and test scripts that all...

Malicious code in a-onesite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b1ed6ca931448c083b5356eae6ad5af3cce9011d70fce4ce4ad427349991856 [email protected] ships an empty index.js and no library functionality. Its package.json declares preinstall, preupdate, and test scripts that all...

K000163395: wget vulnerabilities CVE-2026-58469, CVE-2026-58471, and CVE-2026-58472

Security Advisory Description CVE-2026-58469 GNU Wget through 1.25.0, fixed in commit 37a40fc, contains a heap buffer underread vulnerability in the cleanmetalinkstring function within src/metalink.c that allows a malicious server to trigger memory corruption by serving a Metalink document...

CVE-2026-94574

A local cross-user code execution vulnerability exists in GNU wget Windows builds from eternallybored.org due to a hardcoded configuration file path C:\msys64 that is writable by unprivileged users, allowing for arbitrary code execution via the useaskpass directive, potentially allowing local...

CVE-2026-94574 CVE-2026-94574

A local cross-user code execution vulnerability exists in GNU wget Windows builds from eternallybored.org due to a hardcoded configuration file path C:\msys64 that is writable by unprivileged users, allowing for arbitrary code execution via the useaskpass directive, potentially allowing local...

CVE-2026-94574 CVE-2026-94574

A local cross-user code execution vulnerability exists in GNU wget Windows builds from eternallybored.org due to a hardcoded configuration file path C:\msys64 that is writable by unprivileged users, allowing for arbitrary code execution via the useaskpass directive, potentially allowing local...

EUVD-2026-84682

A local cross-user code execution vulnerability exists in GNU wget Windows builds from eternallybored.org due to a hardcoded configuration file path C:\msys64 that is writable by unprivileged users, allowing for arbitrary code execution via the useaskpass directive, potentially allowing local...

CVE-2026-94574

A local cross-user code execution vulnerability exists in GNU wget (specifically Windows builds from eternallybored.org ). The root cause is a hardcoded configuration file path at C:\msys64 which is writable by unprivileged users. This allows an attacker to achieve arbitrary code execution via th...

CVE-2026-94574

A local cross-user code execution vulnerability exists in GNU wget Windows builds from eternallybored.org due to a hardcoded configuration file path C:\msys64 that is writable by unprivileged users, allowing for arbitrary code execution via the useaskpass directive, potentially allowing local...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: busybox (UTSA-2026-091364)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091364 advisory. Busybox contains a Missing SSL certificate validation vulnerability in The busybox wget applet that can result in arbitrary code execution. This attack appear to be...

CVE-2026-94574: Undefined Security Weakness

A local cross-user code execution vulnerability exists in GNU wget Windows builds from eternallybored.org due to a hardcoded configuration file path C:\msys64 that is writable by unprivileged users, allowing for arbitrary code execution via the useaskpass directive, potentially allowing local...

PT-2026-97018

Name of the Vulnerable Software and Affected Versions GNU wget Windows builds from eternallybored.org affected versions not specified Description A local cross-user code execution issue exists due to a hardcoded configuration file path at C:msys64 that can be written to by unprivileged users. Thi...

EulerOS Virtualization 2.10.0 : wget (EulerOS-SA-2026-3893)

According to the versions of the wget packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the htmlquotestring function in...

SUSE SLES12 Security Update : wget (SUSE-SU-2026:4074-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4074-1 advisory. This update for wget fixes the following issue: - CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE bsc1276962. Tenable has...

EulerOS Virtualization 2.10.1 : wget (EulerOS-SA-2026-3859)

According to the versions of the wget packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the htmlquotestring function in...

SUSE SLED15 / SLES15 Security Update : wget (SUSE-SU-2026:4049-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4049-1 advisory. This update for wget fixes the following issue: - CVE-2026-16599: server-controlled unbounded MD5 loop in FTP OPIE...

OESA-2026-3910 wget security update

GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc. Security Fixes: GNU wget is...

EulerOS Virtualization 2.12.1 : wget (EulerOS-SA-2026-3626)

According to the versions of the wget package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : GNU Wget through 1.25.0, fixed in commit c2640fe, contains a heap buffer overflow vulnerability in the convertfname function within...

EulerOS Virtualization 2.11.0 : wget (EulerOS-SA-2026-3569)

According to the versions of the wget package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are...

EulerOS 2.0 SP10 : wget (EulerOS-SA-2026-3727)

According to the versions of the wget packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNU Wget through 1.25.0, fixed in commit dd692d9, contains a heap buffer overflow vulnerability in the htmlquotestring function in src/convert.c tha...