EUVD-2026-92543

Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a...

MAL-2026-17625 Malicious code in serpacksven (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89aa9ce877a176ce5c26aec2bce6e397ad287a6f26f625870cd5d6a5bef60cc9 The tarball contains only package.json and json.txt. The declared main index.js is absent, so requiring the package fails — the package is not a...

MAL-2026-17626 Malicious code in serpacksven1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20d4a6a2715973b427bb0aa2b7a493ca711b7f16b5f47f90062edf790e0186a6 The tarball ships no JavaScript — the declared main: index.js is absent — and contains only 10 byte-identical copies of a PowerShell dropper under...

MAL-2026-17624 Malicious code in documenclient (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffd20318a8d48dc20fee95097373ebd1039481031985164a651d2b68d366565a [email protected] publishes an npm package whose only shipped content is a heavily obfuscated PowerShell script embedded in the README. The script...

Malicious code in serpacksven (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89aa9ce877a176ce5c26aec2bce6e397ad287a6f26f625870cd5d6a5bef60cc9 The tarball contains only package.json and json.txt. The declared main index.js is absent, so requiring the package fails — the package is not a...

Malicious code in serpacksven1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20d4a6a2715973b427bb0aa2b7a493ca711b7f16b5f47f90062edf790e0186a6 The tarball ships no JavaScript — the declared main: index.js is absent — and contains only 10 byte-identical copies of a PowerShell dropper under...

Malicious code in documenclient (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffd20318a8d48dc20fee95097373ebd1039481031985164a651d2b68d366565a [email protected] publishes an npm package whose only shipped content is a heavily obfuscated PowerShell script embedded in the README. The script...

EUVD-2026-92518

A flaw was found in Quay. A cross-site scripting XSS vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper inp...

CVE-2026-102295 Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter

A flaw was found in Quay. A cross-site scripting XSS vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper inp...

CVE-2026-102295

A flaw was found in Quay. A cross-site scripting XSS vulnerability in the OAuth callback handler allows a remote attacker to execute arbitrary JavaScript code within a user's browser session. By tricking a logged-in user into visiting a specially crafted link, an attacker can exploit improper inp...

MAL-2026-17622 Malicious code in dzyhaxz-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08fd08c1026dee023b11946f939f5fb1c5763566c9577ccb99c2aa7a3c0c2684 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17620 Malicious code in dzyclutch-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8bd1abac47f016ac53777bcc08d76d15a48330f1c53931e61d6704ce6f3398d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-17619 Malicious code in dzyclutch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b5f3b0ba07dd680638f7c46393ed9a625dfa46962fbc53c5f17534995bb334f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dzyhaxz-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08fd08c1026dee023b11946f939f5fb1c5763566c9577ccb99c2aa7a3c0c2684 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dzyclutch-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8bd1abac47f016ac53777bcc08d76d15a48330f1c53931e61d6704ce6f3398d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in dzyhaxz-libsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c8e7ca99c316f4b011bacc98bd321fb6e0afab999695d94c2cf41b1bff48b17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diezyclutch/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 220c03791e2404d6bddaf8542dedfd4b7b69f4519b260ab8cb162791d5f389d1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in dzyclutch-libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63716521c367b7aea5217499683a4fced3139831cc949b92387538692a679287 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17621 Malicious code in dzyclutch-libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63716521c367b7aea5217499683a4fced3139831cc949b92387538692a679287 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17623 Malicious code in dzyhaxz-libsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c8e7ca99c316f4b011bacc98bd321fb6e0afab999695d94c2cf41b1bff48b17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...