MAL-2026-2976 Malicious code in gleb-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1195db21d930574e3f893e03ace1f465579fc9a50f319979b05f57a0a6d8e252 The package gleb-js was found to contain malicious code. Source: ghsa-malware 24151762712a7288d42bf902b1d0d205f13c6f76668490e7043fe846a8fd241f Any...

CVE-2026-41130

Craft CMS is a content management system CMS. In versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14, the resource-js endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. When trustedHosts is not explicitly restricted default...

Craft CMS code issues and vulnerabilities

Craft CMS is an open-source content management system developed by Craft CMS. There are code vulnerabilities in Craft CMS. These vulnerabilities stem from the resource-js endpoint, which allows unauthenticated requests to proxy remote JavaScript resources. When trustedHosts is not explicitly...

CVE-2026-41130: Server-Side Request Forgery (SSRF)

Craft CMS is a content management system CMS. In versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14, the resource-js endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. When trustedHosts is not explicitly restricted default...

CVE-2026-41130 Craft CMS has a host header injection leading to SSRF via resource-js endpoint

Craft CMS is a content management system CMS. In versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14, the resource-js endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. When trustedHosts is not explicitly restricted default...

CVE-2026-41130 Craft CMS has a host header injection leading to SSRF via resource-js endpoint

Craft CMS is a content management system CMS. In versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14, the resource-js endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. When trustedHosts is not explicitly restricted default...

CVE-2026-41130

Craft CMS is a content management system CMS. In versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14, the resource-js endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. When trustedHosts is not explicitly restricted default...

EUVD-2026-24571

Craft CMS is a content management system CMS. In versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14, the resource-js endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. When trustedHosts is not explicitly restricted default...

CVE-2026-41130 Craft CMS has a host header injection leading to SSRF via resource-js endpoint

Craft CMS is a content management system CMS. In versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14, the resource-js endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. When trustedHosts is not explicitly restricted default...

PT-2026-33983

Name of the Vulnerable Software and Affected Versions Custom css-js-php versions prior to 2.0.8 Description The plugin fails to properly sanitize user input before incorporating it into a SQL query. The resulting output is then passed to the eval function, which enables unauthenticated users to...

Follow Redirects Information Leak Vulnerability

Follow Redirects is an open-source Node.js module that automatically follows HTTP redirects. Versions of Follow Redirects prior to 1.16.0 had a vulnerability related to information leakage. This vulnerability occurred when HTTP requests followed cross-domain redirects, and only authorization, pro...

​​Supply Chain Compromise Impacts Axios Node Package Manager​

The Cybersecurity and Infrastructure Security Agency CISA is releasing this alert to provide guidance in response to the software supply chain compromise of the Axios node package manager npm.1 Axios is an HTTP client for JavaScript that developers commonly use in Node.js and browser environments...

CVE-2026-6621

A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknown function of the file index.js. This manipulation of the argument proto causes improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The...

PT-2026-35486

Root has patched SNYK-JS-AXIOS-6124857 in the @rootio/axios package for Root:npm. Multiple fixed versions available...

PT-2026-35488

Root has patched SNYK-JS-AXIOS-9403194 in the @rootio/axios package for Root:npm. Multiple fixed versions available...

PT-2026-35487

Root has patched SNYK-JS-AXIOS-6144788 in the @rootio/axios package for Root:npm. Multiple fixed versions available...

Malicious code in pil2-stark-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d38245d3114b579956426c150e00f8821821c418e0d87077788d0180ed19a054 The package pil2-stark-js was found to contain malicious code...

MAL-2026-2793 Malicious code in pil2-stark-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d38245d3114b579956426c150e00f8821821c418e0d87077788d0180ed19a054 The package pil2-stark-js was found to contain malicious code...

Malicious code in pil2-proofman-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec44a98d8fd4dfdf91d31b7990ec8005ee4d4aab1d6030d18e86f84758659093 The package pil2-proofman-js was found to contain malicious code...

MAL-2026-2792 Malicious code in pil2-proofman-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec44a98d8fd4dfdf91d31b7990ec8005ee4d4aab1d6030d18e86f84758659093 The package pil2-proofman-js was found to contain malicious code...