6860 matches found
Malicious code in tramvai-tinkoff-module-legacy-popup (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06c940ade7f46d36a0ef00f120e2c6422c6ebc810c36429935ffd538da25bf1b On require of tramvai-tinkoff-module-legacy-popup, index.js loads setup.js, which selects a platform-specific payload from a hardcoded binary map,...
PT-2026-76201
Summary When fetch was called, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a denied IP,...
CVE-2026-70604: Permissive Cross-domain Policy with Untrusted Domains
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 40.9.3, 41.4.0, and 42.0.0, a custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remot...
PT-2026-68983
Impact A custom scheme registered with supportFetchAPI: true but without corsEnabled: true was not subject to CORS enforcement. A page loaded from a remote origin could therefore fetch or XMLHttpRequest that scheme cross-origin and read the full response body, rather than the read being blocked...
PT-2026-68209
Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.10 Electron versions prior to 40.9.3 Electron versions prior to 41.4.0 Electron versions prior to 42.0.0 Description A custom scheme registered with supportFetchAPI: true but without corsEnabled: true does not...
Malicious code in vitest-preview-pro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 367fd88886da38fc8a88929cfb486d6031ee42d44499b5f7a2d47d4e91d5b075 The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nodemailer with an added...
MAL-2026-11538 Malicious code in eacq-payform-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac90938ceb191a40f640c12f11258ef8a518d24480072eeaa0791a155a49c724 On require of the package, index.js loads vendor.js which selects a platform-specific endpoint, fetches an opaque binary over HTTPS from Cloudflare...
Malicious code in eacq-payform-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac90938ceb191a40f640c12f11258ef8a518d24480072eeaa0791a155a49c724 On require of the package, index.js loads vendor.js which selects a platform-specific endpoint, fetches an opaque binary over HTTPS from Cloudflare...
CVE-2026-70591
Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...
EUVD-2026-52973
Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on...
GHSA-G366-23FW-GGP6 Ghost: Mobiledoc image-size fetch SSRF
Impact When re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card a...
Ghost: Mobiledoc image-size fetch SSRF
Impact When re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user able to create or edit posts could therefore point an image card a...
NPM: Ghost: Mobiledoc image-size fetch SSRF
NPM: Ghost: Mobiledoc image-size fetch SSRF vulnerability discovered by ? in WordPress Npm ghost versions = 6.19.4, 6.21.1...
MAL-2026-11526 Malicious code in nagix-nodejs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8ce2f0b04a8b6a69d540678c440c14c0c4b9b5a6cf6a957e020aceff239c279 package.json declares "postinstall": "node test.js", which auto-executes on npm install and invokes two exported routines in index.js. The first...
MAL-2026-11525 Malicious code in nagix-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8c77b8796f45d4e9888fe751dac62ad9f85334f29a64d8b0b2f50377611d6fc package.json declares postinstall: node test.js, which auto-executes on npm install and performs three attacker-beneficial actions against the...
Open WebUI: DNS Rebinding SSRF Bypass
Summary Open WebUI vetted user-supplied URLs by resolving the hostname once and rejecting private, loopback and link-local addresses, then let the HTTP client resolve that hostname again at connect time. An attacker who controls the authoritative DNS for a hostname they submit can answer with a...
CLSA-2026-1776299664 TuxCare security update for npm-registry-fetch (1 CVE)
TuxCare rebuilt npm-registry-fetch to address 1 CVE. Fixed in 3.9.1-tuxcare.1...
CLSA-2026-1775003169 TuxCare security update for node-fetch (1 CVE)
TuxCare rebuilt node-fetch to address 1 CVE. Fixed in 2.6.1-tuxcare.1...