121580 matches found
Malicious code in tiny-folder-tree (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb7707665659f287294c31f37c4eff9ceba537e9b54859837615929c296a9540 [email protected] declares a postinstall script src/build.js that runs on npm install. The script performs a DNS TXT lookup for...
MAL-2026-15907 Malicious code in tiny-folder-tree (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb7707665659f287294c31f37c4eff9ceba537e9b54859837615929c296a9540 [email protected] declares a postinstall script src/build.js that runs on npm install. The script performs a DNS TXT lookup for...
MAL-2026-15870 Malicious code in vitest-cli-dev (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ffecbd11a726d511cf3bc41e65ce2a83329b247239d230aeeff9ad70b0e5953 [email protected] is a typosquat package: its name and homepage suggest a vitest tool, but the tarball contains a copy of nodemailer plus an...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
EUVD-2026-70787
MOOS core-moos through 10.4.0 fails to escape database contents when rendering MOOSDB HTTP pages, allowing attackers to inject malicious scripts. Any MOOS publisher can set variable values containing script payloads that execute in the browser of operators viewing the web interface...
PT-2026-85477
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with . Attackers can craft a malicious URL with an error parameter containing script breakout...
CVE-2026-85577: Improper Neutralization of Input During Web Page Generation
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php that allows unauthenticated attackers to inject arbitrary JavaScript by closing the script tag with . Attackers can craft a malicious URL with an error parameter containing script breakout...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
CVE-2026-85453 MOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross-Site Scripting
MOOS core-moos through 10.4.0 fails to escape database contents when rendering MOOSDB HTTP pages, allowing attackers to inject malicious scripts. Any MOOS publisher can set variable values containing script payloads that execute in the browser of operators viewing the web interface...
CVE-2026-78593
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond th...
CVE-2026-78593 Improper Control of Generation of Code in Kibana Leading to Privilege Escalation
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond th...
EUVD-2026-70658
An insufficiently validated configuration field in Kibana's Cribl integration allows an authenticated user holding Kibana Fleet management privileges to inject attacker-controlled expressions into a server-side script template, resulting in an Elasticsearch ingest pipeline being written beyond th...
CVE-2026-84773
Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...
CVE-2026-81776 WordPress WP QuickLaTeX plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP QuickLaTeX = 3.8.8 versions...
Malicious code in @quantixfinance/config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3064c4e02a71b4d0369c649c6aafe3ed3ecde9e7d119e368b42dc7507ae2bb03 The package's preinstall lifecycle script enumerates process.env and filters keys by a broad secret-shaped substring list key, secret, token, pass,...
MAL-2026-15850 Malicious code in @quantixfinance/config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3064c4e02a71b4d0369c649c6aafe3ed3ecde9e7d119e368b42dc7507ae2bb03 The package's preinstall lifecycle script enumerates process.env and filters keys by a broad secret-shaped substring list key, secret, token, pass,...
Malicious code in @quantixfinance/tron (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcf106f622a8d60232e7d296737eab7e44ffc42a598f40b4b2afea24aaa15f7c The package's declared preinstall script iterates process.env, filters keys against a broad credential/secret keyword list key, secret, token, pass,...
Malicious code in @quantixfinance/common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be7f05a2980d77035384d4d27df1058513e5cd1cff50fb5ce040e85986fe0231 The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list of secret-shaped substrings...
MAL-2026-15849 Malicious code in @quantixfinance/common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be7f05a2980d77035384d4d27df1058513e5cd1cff50fb5ce040e85986fe0231 The package's preinstall lifecycle script iterates process.env and collects any variable whose name matches a broad list of secret-shaped substrings...
MAL-2026-15852 Malicious code in @quantixfinance/sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2fde29a3682637d696a6bb2614ba4ddf9b7f2b99c3d3a65380ced1ce3d7f57a @quantixfinance/[email protected] ships an inert library body index.js exports an empty QuantixSDK class and a createClient stub while its preinstall lifecyc...