124495 matches found
MAL-2026-13969 Malicious code in @hzero-front-ui/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7821a8d1a76ccfc9b3e0649ad6b600927c9c3448ee083d47809026588daa77ca Package @hzero-front-ui/[email protected] is a hollow shell index.js is only module.exports = ; whose sole functional content is preinstall/install...
Malicious code in @hzero-front-ui/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7821a8d1a76ccfc9b3e0649ad6b600927c9c3448ee083d47809026588daa77ca Package @hzero-front-ui/[email protected] is a hollow shell index.js is only module.exports = ; whose sole functional content is preinstall/install...
Malicious code in @hzero-front-ui/hzero-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1b33c04eb2fb12d521b76353993517475d9239c9790c085d16c0c3d0a4ba2f9 Package @hzero-front-ui/[email protected] is a scope-lookalike of @hzero-front/hzero-ui with a placeholder version, empty author, generic description...
MAL-2026-13970 Malicious code in @hzero-front-ui/hzero-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1b33c04eb2fb12d521b76353993517475d9239c9790c085d16c0c3d0a4ba2f9 Package @hzero-front-ui/[email protected] is a scope-lookalike of @hzero-front/hzero-ui with a placeholder version, empty author, generic description...
MAL-2026-13971 Malicious code in @hzero-front-ui/themes (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aac0df9dcfaeaf0958ef981d9c5cd9dd4ab1fe0de41bd20894c261dade6bb486 package.json defines preinstall and install lifecycle scripts that run automatically on npm install. The scripts collect the installer's whoami,...
Malicious code in @hzero-front-ui/themes (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aac0df9dcfaeaf0958ef981d9c5cd9dd4ab1fe0de41bd20894c261dade6bb486 package.json defines preinstall and install lifecycle scripts that run automatically on npm install. The scripts collect the installer's whoami,...
Malicious code in xrblocks-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76393473878ee61f371bcb238c278a7ae68f2a802d5a8b017d72812ab61c3c09 The package's postinstall lifecycle script runs automatically on npm install and collects installer host identifiers hostname, platform, arch, node...
MAL-2026-13988 Malicious code in xrblocks-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76393473878ee61f371bcb238c278a7ae68f2a802d5a8b017d72812ab61c3c09 The package's postinstall lifecycle script runs automatically on npm install and collects installer host identifiers hostname, platform, arch, node...
CVE-2026-72676
Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later...
CVE-2026-73650
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because...
DEBIAN-CVE-2026-73650
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because...
CVE-2026-72676
Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later...
CVE-2026-72676 Improper Control of Generation of Code in Fleet Server Leading to Code Injection
Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later...
CVE-2026-49864
wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string "escapeMarkup: false". Any output the victim renders - a "cat"'d file, a tailed...
Malicious code in @opezneppelin/contracts (npm)
Source: amazon-inspector abe04ec28ed56cb0a253131129df8078d425f8a0c579c439ced9c75b6977a6ab @opezneppelin/contracts is a typosquat of @openzeppelin/contracts. Its postinstall lifecycle script scripts/postinstall.js hex-escapes all module names, method names, and string constants fs, https,...
Malicious code in core-js-buffer (npm)
Source: amazon-inspector ec43d0c13a26ec0a6e6dacf51f52a66f48c7dbce7f4a00dbcb72a0749fa6b4e3 The package's postinstall script package.json declares "postinstall": "node init.js" performs two hostile actions at install time. First, init.js POSTs installer host and user identifiers — os.hostname,...
DEBIAN-CVE-2026-73648
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...
CVE-2026-73650 SVGO: removeScripts plugin leaves some executable scripts intact
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because...
CVE-2026-73650 SVGO: removeScripts plugin leaves some executable scripts intact
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because...
CVE-2026-73650
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because...