CVE-2026-41130 Craft CMS has a host header injection leading to SSRF via resource-js endpoint

Craft CMS is a content management system CMS. In versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14, the resource-js endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. When trustedHosts is not explicitly restricted default...

CVE-2026-41130 Craft CMS has a host header injection leading to SSRF via resource-js endpoint

Craft CMS is a content management system CMS. In versions on the 4.x branch through 4.17.8 and the 5.x branch through 5.9.14, the resource-js endpoint in Craft CMS allows unauthenticated requests to proxy remote JavaScript resources. When trustedHosts is not explicitly restricted default...

PT-2026-33983

Name of the Vulnerable Software and Affected Versions Custom css-js-php versions prior to 2.0.8 Description The plugin fails to properly sanitize user input before incorporating it into a SQL query. The resulting output is then passed to the eval function, which enables unauthenticated users to...

Follow Redirects 信息泄露漏洞

Follow Redirects is an open-source Node.js module that automatically follows HTTP redirects. Versions of Follow Redirects prior to 1.16.0 had a vulnerability related to information leakage. This vulnerability occurred when HTTP requests followed cross-domain redirects, and only authorization, pro...

​​Supply Chain Compromise Impacts Axios Node Package Manager​

The Cybersecurity and Infrastructure Security Agency CISA is releasing this alert to provide guidance in response to the software supply chain compromise of the Axios node package manager npm.1 Axios is an HTTP client for JavaScript that developers commonly use in Node.js and browser environments...

CVE-2026-6621

A vulnerability was determined in 1024bit extend-deep up to 0.1.6. The impacted element is an unknown function of the file index.js. This manipulation of the argument proto causes improperly controlled modification of object prototype attributes. Remote exploitation of the attack is possible. The...

PT-2026-35486

Root has patched SNYK-JS-AXIOS-6124857 in the @rootio/axios package for Root:npm. Multiple fixed versions available...

PT-2026-35487

Root has patched SNYK-JS-AXIOS-6144788 in the @rootio/axios package for Root:npm. Multiple fixed versions available...

PT-2026-35488

Root has patched SNYK-JS-AXIOS-9403194 in the @rootio/axios package for Root:npm. Multiple fixed versions available...

Malicious code in pil2-stark-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d38245d3114b579956426c150e00f8821821c418e0d87077788d0180ed19a054 The package pil2-stark-js was found to contain malicious code...

MAL-2026-2793 Malicious code in pil2-stark-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d38245d3114b579956426c150e00f8821821c418e0d87077788d0180ed19a054 The package pil2-stark-js was found to contain malicious code...

Malicious code in pil2-proofman-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec44a98d8fd4dfdf91d31b7990ec8005ee4d4aab1d6030d18e86f84758659093 The package pil2-proofman-js was found to contain malicious code...

MAL-2026-2792 Malicious code in pil2-proofman-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec44a98d8fd4dfdf91d31b7990ec8005ee4d4aab1d6030d18e86f84758659093 The package pil2-proofman-js was found to contain malicious code...

Node.js: Unbounded memory growth in `node:http2` clients via attacker-controlled ORIGIN frames

Vulnerability description not provided...

Malicious code in pretty-logger-js (npm)

pretty-logger-js is a malicious npm package that when imported downloads and executes a C2 dropper from https://www.jsonkeeper.com/b/OTOAQ. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29e46da449e6d21efcef5e9975a2f8e90c31369882800ed4c560ae47ade99b53 The packa...

MAL-2026-2908 Malicious code in pretty-logger-js (npm)

pretty-logger-js is a malicious npm package that when imported downloads and executes a C2 dropper from https://www.jsonkeeper.com/b/OTOAQ. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29e46da449e6d21efcef5e9975a2f8e90c31369882800ed4c560ae47ade99b53 The packa...

1router (>=0.3.96, <=1.0.2), 8router (>=0.5.12, <=0.5.24) +2163 more potentially affected by CVE-2026-41240 via dompurify (>=3.0.0, <=3.3.3)

dompurify NPM version =3.0.0, =0.3.96, =0.5.12, =0.3.33, =0.3.0, =0.5.0, =0.4.71, =1.0.0, =1.5.1, =0.18.0-beta.0, =0.1.0-alpha.1, =0.1.0, =0.1.0, =0.0.0-dev-20240828032938, =6.3.3 and more Source cves: CVE-2026-41240 Source advisory: SNYK:JS-DOMPURIFY-16078387...

RockyLinux 8 : nodejs:20 (RLSA-2026:8339)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:8339 advisory. minimatch: minimatch: Denial of Service via specially crafted glob patterns CVE-2026-26996 minimatch: Minimatch: Denial of Service via catastrophic...

Exploit for Code Injection in Flowiseai Flowise

CVE-2025-59528 — Flowise AI Authenticated Remote Code Executio...

Malicious code in js-logger-pack (npm)

js-logger-pack is a fake npm logger that the attacker developed openly on the registry over 23 versions across two weeks 2026-04-01 to 2026-04-15. Version 1.1.20, published hours after initial detection, is a re-obfuscation of the same payload with a new hash — same C2, same capabilities. Early...