Malicious code in react-native-country-select (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 769c13bead812dac05aaece43d165b10a7574c48a0a030b703e022325f736380 The package react-native-country-select was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1932 Malicious code in react-native-international-phone-number (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f86d66bcbb0f2abf075d3d4ce6a18c3a8ec1563e35087a9fe409f56f9fb64a9f The package react-native-international-phone-number was found to contain malicious code. Source: ghsa-malware...

Malicious code in @iflow-mcp/watercrawl-watercrawl-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 824ca65d425a95c473a1bd8d193811e3ab4a816ba82e3e2950e5dde508ae2bd0 The package @iflow-mcp/watercrawl-watercrawl-mcp was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1930 Malicious code in @iflow-mcp/watercrawl-watercrawl-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 824ca65d425a95c473a1bd8d193811e3ab4a816ba82e3e2950e5dde508ae2bd0 The package @iflow-mcp/watercrawl-watercrawl-mcp was found to contain malicious code. Source: ghsa-malware...

qui CORS Misconfiguration: Arbitrary Origins Trusted

Summary The application implements an HTML5 cross-origin resource sharing CORS policy that allows access from any domain. While the application is typically deployed within a trusted local network, successful exploitation of this weakness does not require any direct access to the instance by the...

MAL-2026-1927 Malicious code in changelog-logger-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34f7f28c6593ecad4f4308faa51ad2d06d6feb541dbc1ab634179bced34a3d95 The package changelog-logger-utils was found to contain malicious code. Source: ghsa-malware...

Malicious code in tokenshower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e31db2e66d226160d10fe5f31a29d7b95cba1d0751cc575c0cf6130679170c7a The package tokenshower was found to contain malicious code. Source: ghsa-malware f9fdcfed91dfe75ee3b371ba973a183f42ff3085a29be233f33b5e34249d18cf An...

MAL-2026-1925 Malicious code in jsonify-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ef3f7d9cb714309502cac987c904c29a8eda1fda1fcd8f5fffabfa339a64369 The package jsonify-parser was found to contain malicious code. Source: ghsa-malware 4d17ffa1ebe907cee2cc4cf5fd22ab76acd112213237bcac49b62b06a002c1cb...

Malicious code in jsonify-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ef3f7d9cb714309502cac987c904c29a8eda1fda1fcd8f5fffabfa339a64369 The package jsonify-parser was found to contain malicious code. Source: ghsa-malware 4d17ffa1ebe907cee2cc4cf5fd22ab76acd112213237bcac49b62b06a002c1cb...

When tax season becomes cyberattack season: Phishing and malware campaigns using tax-related lures

In this article 1. A wide range of tax-themed campaigns 2. How to protect users and organization against tax-themed campaigns 3. Microsoft Defender detection and hunting guidance 4. Indicators of compromise During tax season, threat actors reliably take advantage of the urgency and familiarity of...

AVideo has an OS Command Injection via Unescaped URL in LinkedIn Video Upload Shell Command

Summary The uploadVideoToLinkedIn method in the SocialMediaPublisher plugin constructs a shell command by directly interpolating an upload URL received from LinkedIn's API response, without sanitization via escapeshellarg. If an attacker can influence the LinkedIn API response via MITM, compromis...

EUVD-2026-13075

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credential...

CVE-2026-21788 HCL Connections is vulnerable to cross-site scripting (XSS)

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credential...

CVE-2026-21788

CVE-2026-21788 describes a cross-site scripting (XSS) vulnerability in HCL Connections. The issue allows an attacker to execute arbitrary script in a victim’s browser, potentially leading to cookie-based authentication credential theft and user account compromise, with the impact described as lim...

CVE-2026-21788

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credential...

HCL Connections 安全漏洞

HCL Connections is a corporate collaboration platform developed by the Indian company HCL. There is a security vulnerability in HCL Connections, which can be exploited by cross-site scripting attacks. Attackers may use this vulnerability to execute arbitrary script code in the browsers of unaware...

PT-2026-26279

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credential...

ROS-20260319-73-0025

A vulnerability in the Core component of the Oracle VM VirtualBox virtual machine is related to access differentiation flaws. Exploitation of the vulnerability could allow an attacker to gain full control over the system...

MAL-2026-1576 Malicious code in chai-as-constrained (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea5f87c9fffb9b32d6390a3922c9a8bfc616a693910c9a8d7599cfa8ef11c9e9 The package chai-as-constrained was found to contain malicious code. Source: ghsa-malware...

SQL Injection

phpPgAdmin is vulnerable to SQL Injection. The vulnerability is due to improper sanitization of user-controlled input from the $REQUEST'query' parameter passed to the browseQuery function, which allows an attacker to execute arbitrary SQL commands and compromise the database...