5020 matches found
Malicious code in lib-streak-math (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06cd4f53bed50a86ce85bcd8ebcd672ae7e3c01926cac1efd7f3dcf152484267 The package's main entry index.mjs presents itself as a math helper but contains a top-level async IIFE that runs on any require/import of the module...
MAL-2026-11141 Malicious code in lib-streak-math (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06cd4f53bed50a86ce85bcd8ebcd672ae7e3c01926cac1efd7f3dcf152484267 The package's main entry index.mjs presents itself as a math helper but contains a top-level async IIFE that runs on any require/import of the module...
CVE-2026-13791
An insufficient validation of untrusted input flaw was found in the Downloads component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=503850012...
CVE-2026-13925
An inappropriate implementation flaw was found in the Downloads component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=511802911...
Malicious Package
Overview streaming-downloads is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in cfgzen (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a904eba641878bae63f76595a468b0faaa66fd27104ac557249e457f005c3fb1 The package installs a site-wide cfgzen.pth containing import dotcfg, which Python's site machinery executes automatically at every interpreter start...
CVE-2026-66476
Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...
CVE-2026-66476
Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...
CVE-2026-66476 WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability
Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...
CVE-2026-66476
CVE-2026-66476 affects WordPress with the Easy Digital Downloads plugin (≤ 3.6.9). The vulnerability is described as Administrator Arbitrary File Deletion in affected versions. The provided metrics indicate network access with high privileges required and UI none, resulting in high availability i...
CVE-2026-66476 WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability
Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...
EUVD-2026-49251
Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...
WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability
Arbitrary File Deletion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Easy Digital Downloads versions = 3.6.9...
CVE-2026-14235
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role-...
CVE-2026-14235 WordPress Download Manager < 3.3.62 - Unauthorized Protected File Download via Reusable Download Key
The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role-...
CVE-2026-66476: Improper Limitation of a Pathname to a Restricted Directory
Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...
PT-2026-64971
Administrator Arbitrary File Deletion in Easy Digital Downloads = 3.6.9 versions...
Hubuum client library (Rust): Configured custom transports may be bypassed, exposing credentials and network traffic
Summary When an application configures hubuumclient with ClientBuilder::withtransport, several client operations still use the built-in reqwest client directly. The bypass includes password login, bearer-token validation, authentication-provider discovery, health and readiness probes, export-outp...
Malicious code in govapkg (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf govapkg presents itself as a client for pkg.go.dev but on any use of its public API get/package/module invokes an internal helper...