124161 matches found
Malicious code in fastify-addon (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cb91c825be697244f8ff069bb56e79aff3b90de7b9947019095b6d0fa2fd270 fastify-addon is a typosquat of the legitimate fastify-plugin package. Its package.json sets repository, bugs, and homepage to...
MAL-2026-5566 Malicious code in fastify-addon (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cb91c825be697244f8ff069bb56e79aff3b90de7b9947019095b6d0fa2fd270 fastify-addon is a typosquat of the legitimate fastify-plugin package. Its package.json sets repository, bugs, and homepage to...
Malicious code in webpack-cache-cycle (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82fa37e2478a7109e376e3a062ccb203806511033930eb7390e45fe7ef404b81 On npm install, package.json's postinstall hook runs node -e "require'./loader.js'". loader.js spawns a detached node process that decodes a...
MAL-2026-5580 Malicious code in webpack-cache-reset (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fee0027f45dd4846b52b99120af39a0bca88f8693047612e946cd8d816f36e6c On npm install, the package's postinstall hook runs loader.js, which hex-decodes the URL https://jsonkeeper.com/b/INN1F an anonymous JSON paste host,...
CVE-2026-46522
creationtimestamp| type| source ---|---|--- 2026-06-11 05:03:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnyh27xmxp2n...
MAL-2026-5569 Malicious code in js-crypto-promise (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9d677e45bee46911d04564e9260f4b569119a4ca0a13a58bcd43760359fbb4f The package's prepinstall.js script base64-decodes a hidden URL stored in a constant misleadingly named HASHKEY decoding to...
Malicious code in spotify-url-resolver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d48e77a28430ecc01968323c62517a7928f9c0db72e086a64eb87e1b63f33b7 On require'spotify-url-resolver', index.js line 21 invokes startBackupLoop at module top level. The loop zips process.cwd the installer's project roo...
MAL-2026-5574 Malicious code in spotify-url-resolver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d48e77a28430ecc01968323c62517a7928f9c0db72e086a64eb87e1b63f33b7 On require'spotify-url-resolver', index.js line 21 invokes startBackupLoop at module top level. The loop zips process.cwd the installer's project roo...
CVE-2026-41706
Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is us...
CVE-2026-34416
OSCAL-GUI contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious input through the project request parameter. Attackers can craft a malicious URL containing unsanitized input that...
CVE-2026-53460
creationtimestamp| type| source ---|---|--- 2026-06-11 00:00:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mnxw7zebcx26 2026-06-11 02:34:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mny6tndjiv2m...
PT-2026-48818
Name of the Vulnerable Software and Affected Versions Presto Player versions prior to 4.2.1 Description The Presto Player plugin for WordPress contains a Stored Cross-Site Scripting issue. The getOverlays function fails to properly sanitize input and escape output, allowing the link url parameter...
PT-2026-48790
Name of the Vulnerable Software and Affected Versions ClipBucket versions prior to 5.5.3 Description The Remote Play feature in ClipBucket v5 allows authenticated users to import external URLs as video sources. The application concatenates these URLs directly into shell commands without proper...
RockyLinux 9 : osbuild-composer (RLSA-2026:22714)
The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:22714 advisory. golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip CVE-2025-61728 golang: net/url: Memory exhaustion in query...
RHEL 9 : buildah (RHSA-2026:25252)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25252 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...
RHEL 9 : skopeo (RHSA-2026:25250)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:25250 advisory. The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and...
CVE-2026-42542
creationtimestamp| type| source ---|---|--- 2026-06-10 22:56:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mnxsn4j3i42y 2026-09-24 19:58:06+00:00| seen| https://bsky.app/profile/theitnerd.ca/post/3mwc24egtxf2f 2026-09-28 17:21:21+00:00| published-proof-of-concept|...
CVE-2026-50131
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validation before runtime document and media fetching. However, the IPv4 validation logic present starting...
Server-side Request Forgery (SSRF)
Overview @fedify/fedify is an An ActivityPub server framework Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the validatePublicUrl process. An attacker can access internal or otherwise restricted network resources by supplying specially crafted URLs that...
Server-side Request Forgery (SSRF)
Overview @fedify/vocab-runtime is a Runtime library for code-generated Activity Vocabulary APIs Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the validatePublicUrl process. An attacker can access internal or otherwise restricted network resources by...