53186 matches found
Malicious code in xdaxx (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7cd212c80bcca22443f4498afeadb70b93268b5904daa521b83242513d478bd The tarball contains a working browser-side account-takeover payload gated to run on noviembrenacional.com. When loaded in a logged-in victim's...
Malicious code in xxdxax (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8922341a391ea133f4e6b95d55da2a7ee404c99a9f88f75bdc2698d3f03cc97c The package's main file i.js is an obfuscated browser-side script — its de-obfuscated form is shipped alongside as original.js — that gates execution...
[SECURITY] Fedora 44 Update: chromium-151.0.7922.71-1.fc44
Chromium is an open-source web browser, powered by WebKit Blink...
CVE-2026-18487 Epiphany: address bar / host spoofing via userinfo in ephy_uri_get_decoded_host()
A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon for example, https://trusted.com:[email protected]/, the address bar and security menus will...
CVE-2026-18487
A flaw was found in Epiphany. An issue in how the browser reads web addresses allows attackers to fake the domain name shown in the address bar. If a user clicks a specially crafted link containing a colon for example, https://trusted.com:[email protected]/, the address bar and security menus will...
brave-browser v1.95.46
Brave Browser This repository is not needed for building the browser and only holds issues, releases and the wiki. The source code and contributions are at https://github.com/brave/brave-core. You can visit our website to get the latest stable release. Resources Issues: Bug reports and feature...
Malicious code in @bananacool467/ui-tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8497bfe55fd379ac7c87c73e99e8c532193a17516996d9ae6cfb856b84a052a The package advertises itself as a UI-components library README compares it to MUI, but its main export surface includes useTerminal, a server-side...
Malicious code in golaaa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43f9a2a9514f30f4def10f6a0a21b4abf4f882fa29a45c6b7c93e96490f49c13 The package's main module cdpinject.js runs on require. It disables TLS certificate verification process-wide...
MAL-2026-13392 Malicious code in golaaa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43f9a2a9514f30f4def10f6a0a21b4abf4f882fa29a45c6b7c93e96490f49c13 The package's main module cdpinject.js runs on require. It disables TLS certificate verification process-wide...
neko v3.1.5
n.eko Welcome to Neko, a self-hosted virtual browser that runs in Docker and uses WebRTC technology. Neko is a powerful tool that allows you to run a fully-functional browser in a virtual environment , giving you the ability to access the internet securely and privately from anywhere. With Neko,...
brave-browser v1.95.44
Brave Browser This repository is not needed for building the browser and only holds issues, releases and the wiki. The source code and contributions are at https://github.com/brave/brave-core. You can visit our website to get the latest stable release. Resources Issues: Bug reports and feature...
PT-2026-68588
Name of the Vulnerable Software and Affected Versions Ultimate Addons for Elementor versions prior to 1.45.3 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. This occurs when the application fails to...
PT-2026-68589
Name of the Vulnerable Software and Affected Versions GiveWP versions prior to 4.16.6 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update GiveWP to version 4.16.6 or...
PT-2026-68579
Name of the Vulnerable Software and Affected Versions WP Data Access versions prior to 5.5.80 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendation...
PT-2026-68504
Name of the Vulnerable Software and Affected Versions JetEngine versions prior to 3.8.13.2 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations...
PT-2026-68743
Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2 Description A TENANT ADMIN can store javascript: URLs within the tenant links configuration, specifically in the website, imprint, and privacyStatement variables. These values are returned to the...
PT-2026-68515
Name of the Vulnerable Software and Affected Versions FiboSearch versions prior to 1.33.1 Description The shop manager component contains a Cross Site Scripting XSS flaw, which occurs when an application includes untrusted data in a web page without proper validation or escaping, allowing an...
PT-2026-68509
Name of the Vulnerable Software and Affected Versions Forminator versions prior to 1.57.0 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations...
QUIC Component DoS
The vulnerability of the QUIC component in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure...