MAL-2026-15628 Malicious code in mfa.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e77a8cf665e78e07a5228adb91c3e204f7f1317a65c8dca3ef7c240f705fe436 lib/cache.js reconstructs a base64-fragmented URL decoding to https://limbomail.com/api/attachment/l4TIRPOsaUxR.603-vhKDRdgKl3RalNTVUZYGPsJy2Y and, t...

Malicious code in tailwindcss-forms-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8948b9d83b1d0eb952b8364b7a15d32efb78d6bed43956bc67a42e151dcfc7a2 Package typosquats @tailwindcss/forms. On require'tailwindcss-forms-style', src/index.js runs evalatob... on a base64 blob appended after...

CVE-2026-78079

Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal...

CVE-2026-78079

Helix Ultimate is a Joomla template published by joomshaper.com . In versions prior to 2.2.10 , an open redirect vulnerability exists in the return redirect handling: arbitrary Base64-encoded strings were accepted as return parameters without verifying that the resolved target was an internal sit...

CVE-2026-78079 Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal...

EUVD-2026-68523

Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal...

CVE-2026-81853 AshAdmin composite primary key decoding accepts arbitrary fields, enabling a secret-attribute oracle

Authorization Bypass Through User-Controlled Key vulnerability in ash-project ashadmin turns a record-lookup URL into an equality oracle over sensitive attributes. AshAdmin.Helpers.decodeprimarykey/2 decodes the composite-primary-key form Base64 plus ETF and returns the decoded map verbatim as th...

PT-2026-83843

Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal...

CVE-2026-78079: URL Redirection to Untrusted Site

Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal...

CVE-2026-81633

CVE-2026-81633 is an improper input validation vulnerability in ash-project ash_graphql (Elixir GraphQL library). The function resolve_node/2 base64-decodes a client-supplied global ID and passes the type segment directly to Map.fetch!/2, which raises an unhandled KeyError when the type is not a ...

MAL-2026-15554 Malicious code in eth-pino (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81e08c035ca41519f1d57d389027befac80a8ee8405612825b633967db5fb8c1 On require, lib/initializeCaller.js runs a top-level async IIFE that decodes a base64-obfuscated URL to...

Malicious code in mfacord (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e8426c0e4e80e0bd9839d8517e060bd923775b8a3e100aab57e18b4f47c970e On require'mfacord', index.js loads lib/cache.js, which on win32 decodes a hardcoded URL...

MAL-2026-15557 Malicious code in mfacord (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e8426c0e4e80e0bd9839d8517e060bd923775b8a3e100aab57e18b4f47c970e On require'mfacord', index.js loads lib/cache.js, which on win32 decodes a hardcoded URL...

CVE-2026-58107 Authenticated Remote Denial of Service via Unbounded zlib Decompression in massStoreRun

CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a...

python: Python base64: Incomplete data decoding due to premature stop at padding

A flaw was found in the Python base64 module. When decoding base64 data using functions like base64.b64decode, the decoding process prematurely stops upon encountering the first padding character. This can result in incomplete data being processed, where any information following the initial...

CVE-2026-47878

DefaultExecutionContextSerializer, used by default in Spring Batch's JDBC job repository, passes Base64-decoded bytes directly to ObjectInputStream.readObject without an ObjectInputFilter that restricts types to a trusted class allowlist. Spring Batch 6.0.0 - 6.0.4 Spring Batch 5.2.6 and earlier...

Malicious code in chai-as-org (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0dfeeefcb4bd27634dd674f55b10aa10da50d39fc8472afb0f8a11297bce6be The package presents itself as a chai/pino-style utility but its index.js unconditionally requires lib/initializeCaller.js, which on load...

kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode

A flaw was found in the Linux kernel's iSCSI target functionality. This vulnerability allows a remote attacker to cause a buffer overflow by sending a specially crafted Challenge-Handshake Authentication Authentication Protocol CHAP response. The system fails to validate the length of the...

kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode

A flaw was found in the Linux kernel's iSCSI target functionality. This vulnerability allows a remote attacker to cause a buffer overflow by sending a specially crafted Challenge-Handshake Authentication Authentication Protocol CHAP response. The system fails to validate the length of the...

MAL-2026-14512 Malicious code in tailwind-scrollbar-hider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aaa2dba899c9723740dfcc2fe8588bcf695f021442bbe8de1156239029bf7987 dist/index.js exports a small legitimate scrollbarHide Tailwind plugin and then executes evalatob'' at module top level, so the payload runs on any...