MAL-2026-12141 Malicious code in beaver-ui-actions-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1daeb30fbebca53883598794ed1662b3d15aca34b78d29257a477431a47201fd The package is published as a React components library but ships no React code. On library load, index.js auto-requires setup.js, which constructs...

GHSA-W72Q-X6W3-7RJ3 Duplicate Advisory: @a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-72qq-p3r5-f7wq. This link is maintained to preserve external references. Original Description The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the U...

CVE-2026-10032

The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...

CVE-2026-10032

The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...

CVE-2026-10032

The CVE-2026-10032 issue involves the openUrl function in @a2ui/web_core, which passes an agent-controlled URL directly to window.open() without URI scheme validation. A malicious actor can supply a javascript: URI as the url argument for a Button component’s functionCall action, allowing arbitra...

CVE-2026-10032 Arbitrary JavaScript Execution via openUrl in @a2ui/web_core

The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...

CVE-2026-10032: Improper Neutralization of Input During Web Page Generation

The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...

PT-2026-67730

Name of the Vulnerable Software and Affected Versions @a2ui/web core affected versions not specified Description The openUrl function fails to validate the URI scheme before passing a URL to window.open. A malicious agent can provide a javascript: URI via the url argument of a Button component's...

PT-2026-105545

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-72qq-p3r5-f7wq. This link is maintained to preserve external references. Original Description The openUrl function in @a2ui/web core passes an agent-controlled URL directly to window.open without validating the...

CVE-2026-15383

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

CVE-2026-15383 Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

EUVD-2026-52174

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

CVE-2026-15383

The Blog Floating Button WordPress plugin, version 1.4.20 and below , is vulnerable to unauthenticated stored XSS . The flaw exists because the plugin fails to sanitize or escape the visitor User-Agent header, which is accepted through an unauthenticated tracking REST endpoint. This malicious inp...

CVE-2026-15383 Blog Floating Button <= 1.4.20 - Unauthenticated Stored XSS via User-Agent Header

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

CVE-2026-15383: Improper Neutralization of Input During Web Page Generation

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

PT-2026-67072

The Blog Floating Button WordPress plugin through 1.4.20 does not sanitize or escape the visitor User-Agent header, which it stores through an unauthenticated tracking REST endpoint and later renders unescaped in an administrator report page. This allows an unauthenticated attacker to store a...

Malicious Package

Overview chalk-button is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in chalk-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 481067cbb929fab749f6e643d96126d0c74251e48609cce55eebf477cfd9ad99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11256 Malicious code in chalk-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 481067cbb929fab749f6e643d96126d0c74251e48609cce55eebf477cfd9ad99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2026-50951

The Improved Save Button plugin for WordPress is vulnerable to second-order SQL Injection via 'metakey' Custom Field via 'Save and Duplicate' Action in all versions up to, and including, 1.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...