122404 matches found
CVE-2026-73250
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory $INSTDIR from PowerEditor/installer/nppSetup.nsi into a PowerShell -Command string used by RegisterMSIX to invoke...
Malicious code in dcfarguscert (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b0841cccc5aa4961351a4cf991d7744a1d7acc4da3824321fed50e1e7b8657d [email protected] registers both preinstall and postinstall lifecycle scripts that invoke src/telemetry.js. On install, telemetry.js collects host...
MAL-2026-13753 Malicious code in dcfarguscert (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b0841cccc5aa4961351a4cf991d7744a1d7acc4da3824321fed50e1e7b8657d [email protected] registers both preinstall and postinstall lifecycle scripts that invoke src/telemetry.js. On install, telemetry.js collects host...
CVE-2026-73084
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...
CVE-2026-73084 Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint
Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...
CVE-2026-21269
CVE-2026-21269 (Adobe ColdFusion) describes a stored cross-site scripting (XSS) vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript could execute in a victim’s browser when visiting the page containing th...
CVE-2026-21269 ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)
ColdFusion is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable...
EUVD-2026-56544
is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope ...
CVE-2026-72925
SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swchtmlminifier 59.0.0, the minifyJson processing in crates/swchtmlminifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script...
MAL-2026-13737 Malicious code in @openzeppelin-4/contracts (npm)
@openzeppelin-4/contracts is a malicious npm package published by npm account mssjeep843 that impersonates OpenZeppelin's @openzeppelin/contracts the v4 line via the look-alike scope @openzeppelin-4, falsely describing itself as a "compatibility distribution". It ships no Solidity contracts — onl...
CVE-2026-72925 SWC HTML minifier may allow script element breakout when minifying embedded JSON
SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swchtmlminifier 59.0.0, the minifyJson processing in crates/swchtmlminifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script...
CVE-2026-72925 SWC HTML minifier may allow script element breakout when minifying embedded JSON
SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swchtmlminifier 59.0.0, the minifyJson processing in crates/swchtmlminifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script...
CVE-2026-72925
CVE-2026-72925 affects SWC’s HTML minification path. The issue in minifyJson within crates/swc_html_minifier/src/lib.rs allowed attacker-controlled JSON inside application/json and application/ld+json script elements to be parsed/serialized without proper HTML escaping, enabling a closing script ...
CVE-2026-72925 SWC HTML minifier may allow script element breakout when minifying embedded JSON
SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swchtmlminifier 59.0.0, the minifyJson processing in crates/swchtmlminifier/src/lib.rs parsed and serialized attacker-controlled JSON in application/json and application/ld+json script...
MAL-2026-13754 Malicious code in dependencyfsdsfdsfg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c53ad8755f0eb26cef8c05b49cdad8c69b93072e0d9ed176b071a7d367349cab package.json declares postinstall: node index.js, causing index.js to run automatically on npm install. The script collects the installer's username...
Malicious code in dependencyfsdsfdsfg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c53ad8755f0eb26cef8c05b49cdad8c69b93072e0d9ed176b071a7d367349cab package.json declares postinstall: node index.js, causing index.js to run automatically on npm install. The script collects the installer's username...
Project CAV3RN continues: Google Apps Script as C2 relay and DNS-based C2 channel selection
Project CAV3RN is a modular espionage framework used against targets in Israel. This report expands on two earlier publications: the first was published in June 2026 as part of our Kaspersky Threat Intelligence Reporting service, and the second was published on Securelist the following month,...
CVE-2026-44762
SAP Data Services Management Console allows an overly permissive Content Security Policy CSP configuration and lacks certain restrictive directives, which could enable an authenticated malicious user to leverage this weakness in combination with another vulnerability to inject and execute malicio...
CVE-2026-44762 Security Misconfiguration in SAP Data Services Management Console
SAP Data Services Management Console allows an overly permissive Content Security Policy CSP configuration and lacks certain restrictive directives, which could enable an authenticated malicious user to leverage this weakness in combination with another vulnerability to inject and execute malicio...
CVE-2026-44762 Security Misconfiguration in SAP Data Services Management Console
SAP Data Services Management Console allows an overly permissive Content Security Policy CSP configuration and lacks certain restrictive directives, which could enable an authenticated malicious user to leverage this weakness in combination with another vulnerability to inject and execute malicio...