Malicious code in chai-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ffc5e8b4e25d2d7787eb9f3bb9607114e5e4290f0afe2350499b78d5f95642 [email protected] presents itself as a Mocha reporter mirroring the legitimate eth-gas-reporter project matching author name, README, and badges, but th...

Malicious code in eth-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcc98bc680f3d0b8c6dcf396d9f2425a5153658259014384cedf82698413755b The published lib/index.js contains 60KB of obfuscated JavaScript appended after a copy of the legitimate web3.js web3-core-subscriptions module. On...

MAL-2026-10374 Malicious code in sixseven2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27752f42df81ff26081065ce5bf64d59fa477dfbed72d1afbd359bffd3ab52df The package declares no install/postinstall/preinstall lifecycle scripts, and its declared main is sw.js — a browser ServiceWorker that uses...

MAL-2026-10378 Malicious code in sixseven6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fce7a5f40c9f40116627ed8a771d60c34786bc52648e39e0741fe392ed0120b The package declares no install/postinstall/preinstall lifecycle scripts, and its declared main is sw.js — a browser ServiceWorker that uses...

MAL-2026-10289 Malicious code in backup5-updated (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fbc0dc5fea4212458853e895b9b9df474401727a4768f47e3016a8c871fd5c7 The package tarball contains multiple heavily obfuscated JavaScript bundles under assets/ AccountPage, DarkVeil, GamesPage, PlusBlockedNote,...

CVE-2026-15552

Enterprise Cloud Database developed by Ragic has a Stored Cross-Site Scripting vulnerability, allowing unauthenticated remote attackers to inject persistent JavaScript code executed in users' browsers upon page load...

MAL-2026-10219 Malicious code in chai-as-precision (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8b5d1218fae5d91755d8f9ca8ed37983e7d589c6fd88012d3ddb29a84a2cc56 Package is published as chai-as-precision but its shipped code mimics pino exports middleware.pino, ships pino.js/proto.js/redaction.js, a name/purpo...

CVE-2026-15552

Enterprise Cloud Database developed by Ragic has a Stored Cross-Site Scripting vulnerability, allowing unauthenticated remote attackers to inject persistent JavaScript code executed in users' browsers upon page load...

CVE-2026-15552 Ragic｜Enterprise Cloud Database - Stored Cross-Site Scripting

Enterprise Cloud Database developed by Ragic has a Stored Cross-Site Scripting vulnerability, allowing unauthenticated remote attackers to inject persistent JavaScript code executed in users' browsers upon page load...

EUVD-2026-43270

Enterprise Cloud Database developed by Ragic has a Stored Cross-Site Scripting vulnerability, allowing unauthenticated remote attackers to inject persistent JavaScript code executed in users' browsers upon page load...

CVE-2026-15552 Ragic｜Enterprise Cloud Database - Stored Cross-Site Scripting

Enterprise Cloud Database developed by Ragic has a Stored Cross-Site Scripting vulnerability, allowing unauthenticated remote attackers to inject persistent JavaScript code executed in users' browsers upon page load...

PT-2026-59359

Summary A vulnerability in the way certain html tags in chat messages are rendered allows attackers to inject JavaScript code into a chat transcript. The JavaScript code will be executed in the user's browser every time that chat transcript is opened, allowing attackers to retrieve the user's...

PT-2026-57849

Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authenticated or anonymous users to execute arbitrary JavaScript by uploading unsanitized SVG files containing embedded scripts in onload event handlers, script tags, or foreignObject elements. Attacker...

Linux Distros Unpatched Vulnerability : CVE-2026-49844

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issu...

PT-2026-59199

Overview Amazon Web Services AWS Security has identified a stored cross-site scripting XSS issue in the jupyterlab-git JupyterLab extension that can lead to remote code execution RCE. The issue exists in the PlainTextDiff.ts component, where the createHeader method passes Git filenames directly t...

PT-2026-57803

Stored Cross-Site Scripting XSS vulnerability in the RD Station Conversas chat. The vulnerability resides in the ‘name’ parameter of the initialization process due to improper sanitization of user input. The vulnerability is not limited to self-exploitation: when a support agent joins the...

PT-2026-59198

Overview Amazon Web Services AWS Security has identified a stored cross-site scripting XSS issue in the jupyterlab-git JupyterLab extension that can lead to remote code execution RCE. The issue exists in the PlainTextDiff.ts component, where the createHeader method passes Git filenames directly t...

PT-2026-59357

Summary Low privileged users can upload HTML files which contain JavaScript code via the /api/v1/files/ backend endpoint. This endpoint returns a file id, which can be used to open the file in the browser and trigger the JavaScript code in the user's browser. Under the default settings, files...

PT-2026-57851

Cross-site scripting vulnerability in phoenixframework phoenix live view allows an attacker to bypass URL scheme validation and execute JavaScript in a victim's browser session. The Phoenix.LiveView.Utils.valid destination!/2 and Phoenix.LiveView.Utils.valid live navigation destination!/2 functio...

PT-2026-59334

Impact OctoPrint versions up to and including 1.11.7 as well as 2.0.0rc1 and 2.0.0rc2 are affected by a vulnerability that allows injection of arbitrary HTML and JavaScript into Suppressed Command notifications popups generated by the printer. An attacker who successfully convinces a victim to...