7854 matches found
MAL-2026-13598 Malicious code in dolyame-ui-selectaccount (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4974c35a90cc1879876080c49f8fafc0f9be576e04e19597d364b55daa951363 On require of the package, index.js loads bootstrap.js and the main-exported lib/telemetry.js, both of which implement the same download-and-execute...
CVE-2026-64663
Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets, on sites whose templates pass untrusted input into affected areas, and exploitation...
CVE-2026-64663 Statamic: Unsafe method invocation via Antlers template resolution allows data destruction
Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets, on sites whose templates pass untrusted input into affected areas, and exploitation...
cloudquery plugins-transformer-basic-v2.7.0
CloudOps, without the chaos CloudQuery is a cloud asset inventory built for platform teams. Sync your cloud infrastructure metadata into your data warehouse, powering insights and automation. Unify data and provide context across AWS, Azure, GCP, and 70+ cloud and SaaS sources such as Wiz, Finout...
CVE-2026-64663: Use of Externally-Controlled Input to Select Classes or Code
Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets, on sites whose templates pass untrusted input into affected areas, and exploitation...
PT-2026-68768
Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.74.1 Statamic versions prior to 6.24.0 Description Manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets. This occurs on sites where templates pass...
Malicious code in bigops-opening-file-handler (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c423840bea5711af66c8f9c24eca1c406a4fa929dc6b9e9d947ec71ea5adc39 On require of bigops-opening-file-handler, index.js loads support.js which selects a platform-specific asset linux/darwin/win32 and downloads an opaq...
MAL-2026-13229 Malicious code in bigops-opening-file-handler (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c423840bea5711af66c8f9c24eca1c406a4fa929dc6b9e9d947ec71ea5adc39 On require of bigops-opening-file-handler, index.js loads support.js which selects a platform-specific asset linux/darwin/win32 and downloads an opaq...
MAL-2026-12822 Malicious code in beaver-ui-search-dropdown (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 117b4f6c7e9e402d92085e427c4b40874e9b6838e16c15562408a0bda241f9ae The package presents itself as a UI dropdown library but on require executes init.js, which selects a platform-specific asset linux/darwin/win32,...
Malicious code in bnpl-blocks-mobile-bnpl-news-cards (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad0b3eb1ec7b37f8483e53212833b81d542aabb784a525e56ce3b2b6e1e48217 The package's index.js loads runtime.js on require, which selects a platform-specific asset, fetches an opaque binary over HTTPS from author-controll...
Malicious code in devplatform-spa-plugin-notifier (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 877337509f36ab52fcfb93d1dc48d77439a5154d077fc047b7263265cfb71468 On module load, index.js requires bootstrap.js which selects a platform-specific asset, downloads an opaque binary from hardcoded Cloudflare Workers...
NetAlertX v26.8.5
NetAlertX - Network Visibility & Asset Intelligence Framework š· Click for more screenshots | | ---|---|--- !presencehttps://assets.kitploit.com/production/public/readmes/295/d2773fcfbdc9d1a31a6e178016e1333b685afe85257bb3...
Hidden Ciphers and Where to Find Them: Static Discovery and Assessment of Cryptographic Assets in Software
Modern software systems rely on cryptography for data protection, authentication, and trust establishment, yet organizations often lack a structured view of the cryptography deployed across source code, configuration, dependencies, and cryptographic files. This lack of visibility complicates...
CVE-2026-67200
Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to...
EUVD-2026-52696
Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to...
CVE-2026-67200 Perspective 5.0.0 Path Traversal via cwd_static_file_handler
Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to...
Exploit for CVE-2026-69083
CVE-2026-69083 ā SiYuan Unauthenticated SQL Injection Unauthe...
CVE-2026-68980
Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...
CVE-2026-68980 Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion
Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...
CVE-2026-68980
CVE-2026-68980 affects Apache NiFi 2.0.0ā2.10.0. The issue is an authorization bypass in Asset management for Parameter Contexts via the REST API: deletion of an Asset is authorized by the provided Parameter Context Identifier without validating the Asset Identifier against the stored one. This c...