MAL-2026-12736 Malicious code in devplatform-react-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e5dd30e287186df59dd24c05aa269894c259f42c8a2a214d513e55c6510474e On require of the package's main entry index.js - init.js, the module reconstructs a set of Cloudflare Workers hostnames from string-split fragments...

Malicious code in devplatform-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c72866f0f03d8960696f4e272cbff49b861cc66557c5250a7d77f90a2310f33c On require'devplatform-sdk', index.js loads polyfill.js which auto-invokes start: it selects a per-OS payload path, fetches a binary from...

Malicious code in devplatform-spa-plugin-ability (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9753b327ec0ed7c7cf204951dd0c1db47db31c79fde8ffad042e8658bb0dc81 On require of the package, index.js loads bootstrap.js which downloads a platform-specific native binary from anonymous Cloudflare Workers hosts...

Malicious code in fb-hr-sites--boxified-form-meetup-subcribe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8aa49d4f3babc81510150e766a38674e971d7553cb05d98b67d0edd24a2fa07 The package's index.js exports an inert class and silently requires./platform inside a swallowed try/catch. On load, platform.js downloads a...

Malicious code in hubert-react-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 765788871d6200a403058846fe3599c2c59588a6b00efc9ee770d7d1501e1b74 The package's main entry index.js unconditionally requires./setup.js on import. setup.js reconstructs Cloudflare Workers hostnames from string-fragme...

MAL-2026-12294 Malicious code in twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bd345f2352931f35e602b49b89ce3977c58dc6ad3e70e3164a0144676ee7c4f On require, index.js loads adapter.js, which downloads a platform-specific binary from Cloudflare Workers hosts under oob-worker.cf10x-.workers.dev...

MAL-2026-12268 Malicious code in tinkoff-statist-browser-typed-client-mb.product.tgeofencing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 471fb9b5c8d45abc59ffda97063561b4882d28109c9959c717fbcd0d9f25c00d On require of this package, index.js loads platform.js which assembles remote hostnames at runtime by concatenating fragmented string arrays to hide...

MAL-2026-12281 Malicious code in tinkoff-terminal-kit-test-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c68d83a8e515bebce3319c94274060bdfcef42f2ba45e96e87515c9cfd11e020 On require of [email protected], index.js loads adapter.js which selects a platform-specific endpoint, downloads an opaque...

MAL-2026-12162 Malicious code in bigops-customer-processing-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9d2fe146d4919092aae053b82b0caacff3789c10e63358f880fa5ab4590b3d2 On require of this package, index.js loads support.js which unconditionally invokes setup. setup assembles C2 hostnames via.join'' from fragmented...

Malicious code in bigops-customer-processing-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9d2fe146d4919092aae053b82b0caacff3789c10e63358f880fa5ab4590b3d2 On require of this package, index.js loads support.js which unconditionally invokes setup. setup assembles C2 hostnames via.join'' from fragmented...

CVE-2026-64580 xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()

In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdevput in xfrm6filldst On the error path where in6devgetdev returns NULL, xfrm6filldst releases the device reference with netdevput but leaves xdst-u.dst.dev set. dstdestroy later...

CVE-2026-64580

CVE-2026-64580 affects the Linux kernel xfrm6 path. On error when in6_dev_get(dev) returns NULL, xfrm6_fill_dst() releases the device reference with netdev_put() but leaves xdst->u.dst.dev set, causing dst_destroy() to netdev_put(dst->dev) again and double-free the net_device reference, und...

PT-2026-68228

Name of the Vulnerable Software and Affected Versions imranrisal-dev Student-Management-System affected versions not specified Description A remote unrestricted upload issue exists within the Shared Upload Helper component. The problem occurs in the storeProfileImage function located in the stude...

CVE-2026-68746: Not Failing Securely

Not Failing Securely 'Failing Open' vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams. A Livebook Agent or App Server connected to Livebook Teams caches the identifier of the...

CVE-2026-18958: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. Affected by this vulnerability is an unknown functionality of the file loginCheckTest.php of the component Login. The manipulation of the...

CVE-2026-66298: Origin Validation Error

Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, including forced evaluation of all cells and runtime restart. Livebook's JS-view feature renders notebook-defined JavaScript inside a sandboxed,...

CVE-2026-18927: Unrestricted Upload of File with Dangerous Type

A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. This affects the function storeProfileImage of the file studentprofilepic.php of the component Shared Upload Helper. Executing a manipulati...

edc (>=0.3.14, <=0.3.16), thenewboston-ml-dev (0.2.3) potentially affected by CVE-2026-15307 via django (3.1.8)

django PYPI version 3.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - edc =0.3.14, =0.3.16 - thenewboston-ml-dev 0.2.3 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

edc (>=0.3.14, <=0.3.16), thenewboston-ml-dev (0.2.3) potentially affected by CVE-2026-15830 via django (3.1.8)

django PYPI version 3.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - edc =0.3.14, =0.3.16 - thenewboston-ml-dev 0.2.3 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...

edc (>=0.3.14, <=0.3.16), thenewboston-ml-dev (0.2.3) potentially affected by CVE-2026-15830 via django (3.1.8)

django PYPI version 3.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - edc =0.3.14, =0.3.16 - thenewboston-ml-dev 0.2.3 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...