CVE-2026-24351: Improper Neutralization of Input During Web Page Generation

PluXml CMS is vulnerable to Stored XSS in Static Pages editing functionality. Attacker with editing privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. The vendor was notified early about this vulnerability, but didn't respond with...

Malicious code in launch-darkly-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b23f579bd6a28b963c5574bfb9148b80de6e59d96c6cb0d10f4d2a35d4c010ac The package launch-darkly-js was found to contain malicious code. Source: ghsa-malware e7a7ecd2770ab8b028a7d1fc05847c7049e1f276886eafb32222fcb81b1d79...

MAL-2026-1050 Malicious code in launch-darkly-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b23f579bd6a28b963c5574bfb9148b80de6e59d96c6cb0d10f4d2a35d4c010ac The package launch-darkly-js was found to contain malicious code. Source: ghsa-malware e7a7ecd2770ab8b028a7d1fc05847c7049e1f276886eafb32222fcb81b1d79...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in js-yaml-4.1.0.tgz

Summary IBM Watson Discovery Cartridge affected by vulnerability in js-yaml-4.1.0.tgz Vulnerability Details CVEID:CVE-2025-64718 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of ...

Microsoft Warns Developers of Fake Next.js Job Repos Delivering In-Memory Malware

A "coordinated developer-targeting campaign" is using malicious repositories disguised as legitimate Next.js projects and technical assessments to trick victims into executing them and establish persistent access to compromised machines. "The activity aligns with a broader cluster of threats that...

Malicious code in duer-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a6a00caf26e2e34291c939e8d0351324c884ba9d9c5b74e5cb9c8d78177a999 The package duer-js was found to contain malicious code. Source: ghsa-malware e7255816711503f7b2f4febb10e3d2d8ef36d2e3067366ece224ad3816fbf03c Any...

Malicious Package

Overview duer-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-1033 Malicious code in duer-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a6a00caf26e2e34291c939e8d0351324c884ba9d9c5b74e5cb9c8d78177a999 The package duer-js was found to contain malicious code. Source: ghsa-malware e7255816711503f7b2f4febb10e3d2d8ef36d2e3067366ece224ad3816fbf03c Any...

UBUNTU-CVE-2026-27699

The basic-ftp FTP client library for Node.js contains a path traversal vulnerability CWE-22 in versions prior to 5.2.0 in the downloadToDir method. A malicious FTP server can send directory listings with filenames containing path traversal sequences ../ that cause files to be written outside the...

Basic FTP 路径遍历漏洞

Basic FTP is a Node.js FTP client library developed by Patrick Juchli. Versions of Basic FTP prior to 5.2.0 contained a path traversal vulnerability. This vulnerability stemmed from a flaw in the downloadToDir method, allowing malicious FTP servers to send file name directories containing path...

Malicious code in js-multer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50fbd8b0061a32bc73c0f643e53d0522b03117bda560c40b279b8cdebe5a1100 The package js-multer was found to contain malicious code. Source: ghsa-malware 330a991375f32abf73368d5d321c5a485cd844db42ccaa02388ebe61bc013376 Any...

Malicious Package

Overview js-multer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-1016 Malicious code in js-multer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50fbd8b0061a32bc73c0f643e53d0522b03117bda560c40b279b8cdebe5a1100 The package js-multer was found to contain malicious code. Source: ghsa-malware 330a991375f32abf73368d5d321c5a485cd844db42ccaa02388ebe61bc013376 Any...

CVE-2026-3050 horilla-opensource horilla Leads global.js cross site scripting

A flaw has been found in horilla-opensource horilla up to 1.0.2. Impacted is an unknown function of the file static/assets/js/global.js of the component Leads Module. This manipulation of the argument Notes causes cross site scripting. The attack is possible to be carried out remotely. The exploi...

CVE-2026-3050

CVE-2026-3050 affects horilla-opensource horilla CRM up to version 1.0.2, specifically the Leads Module’s static/assets/js/global.js. A flaw in an unknown function allows manipulation of the Notes argument to trigger cross-site scripting (XSS) via a remote attack. An exploit has been published. R...

CVE-2025-69985

FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution RCE. The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can...

CVE-2026-3050: Improper Neutralization of Input During Web Page Generation

A flaw has been found in horilla-opensource horilla up to 1.0.2. Impacted is an unknown function of the file static/assets/js/global.js of the component Leads Module. This manipulation of the argument Notes causes cross site scripting. The attack is possible to be carried out remotely. The exploi...

PT-2026-21612

A flaw has been found in horilla-opensource horilla up to 1.0.2. Impacted is an unknown function of the file static/assets/js/global.js of the component Leads Module. This manipulation of the argument Notes causes cross site scripting. The attack is possible to be carried out remotely. The exploi...

CVE-2026-2964

A vulnerability was identified in higuma web-audio-recorder-js 0.1/0.1.1. Impacted is the function extend in the library lib/WebAudioRecorder.js of the component Dynamic Config Handling. Such manipulation leads to improperly controlled modification of object prototype attributes. It is possible t...

CVE-2026-2964

A vulnerability was identified in higuma web-audio-recorder-js 0.1/0.1.1. Impacted is the function extend in the library lib/WebAudioRecorder.js of the component Dynamic Config Handling. Such manipulation leads to improperly controlled modification of object prototype attributes. It is possible t...