telegram-nearby-map

Telegram Nearby Map Telegram Nearby Map uses OpenStreetMap and the official Telegram library to find the position of nearby users. Please note: Telegram's API was updated a while ago to make nearby user distances less precise, preventing exact location calculations. Therefore, Telegram Nearby Map...

Malicious code in hardhat-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b39859996d5d333a776d3ed42a203450ea588adefd91ba46a25a0bef0b17cf02 The package is published as hardhat-pack, a name shape that resembles the Hardhat Ethereum tooling ecosystem, but its README, LICENSE, TypeScript...

MAL-2026-17658 Malicious code in hardhat-bits (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e10f22980d33eea7649312f6b2b0a94637e5b4da400f7d585c58b6902a77944 The package is published as hardhat-bits but its README, LICENSE, docs/, and lib/ files are copied verbatim from the pino logger project, providing...

Malicious code in hardhat-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2f570102756d04aa466677488cd13aacac2eb941176523bc4ff024d214affbb The npm package hardhat-init presents itself as Hardhat initialization tooling and ships a README, LICENSE, and index.d.ts copied from the pino logge...

Malicious code in hardhat-kex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8fa212654344b734814cee2291c9b9b91ecbc353bde5e83740624ee5f263c69 The npm package [email protected] ships an obfuscated 4.5MB single-line bundle at lib/config.js obfuscator.io-style string-array with a 26,234-entry...

MAL-2026-17559 Malicious code in hardhat-kex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8fa212654344b734814cee2291c9b9b91ecbc353bde5e83740624ee5f263c69 The npm package [email protected] ships an obfuscated 4.5MB single-line bundle at lib/config.js obfuscator.io-style string-array with a 26,234-entry...

Malicious code in chaienv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbb73465123d4e732dae815badc8950b40e9447463c1fca697551ab3aa00e020 [email protected] is published as a small Chai environment helper, but its index.js unconditionally loads lib/config.js at require time via const config ...

MAL-2026-17321 Malicious code in chaienv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbb73465123d4e732dae815badc8950b40e9447463c1fca697551ab3aa00e020 [email protected] is published as a small Chai environment helper, but its index.js unconditionally loads lib/config.js at require time via const config ...

CVE-2026-4665: Improper Neutralization of Input During Web Page Generation

The WP Carousel Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted fancybox data-caption attributes in all versions up to, and including, 2.7.10. This is due to the fancybox-config.js script reading the carousel container's id attribute directly from the DOM to...

CVE-2025-5891

A vulnerability classified as problematic was found in Unitech pm2 up to 6.0.6. This vulnerability affects unknown code of the file /lib/tools/Config.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to th...

CVE-2025-5891 Unitech pm2 Config.js redos

A vulnerability classified as problematic was found in Unitech pm2 up to 6.0.6. This vulnerability affects unknown code of the file /lib/tools/Config.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to th...

CVE-2025-5891 Unitech pm2 Config.js redos

A vulnerability classified as problematic was found in Unitech pm2 up to 6.0.6. This vulnerability affects unknown code of the file /lib/tools/Config.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to th...

CVE-2025-5891

A vulnerability classified as problematic was found in Unitech pm2 up to 6.0.6. This vulnerability affects unknown code of the file /lib/tools/Config.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to th...

CVE-2025-5891

CVE-2025-5891 affects Unitech pm2 (versions up to 6.0.6; also noted in advisories for 6.0.8) due to incorrect handling in /lib/tools/Config.js that enables an inefficient regular expression pattern, resulting in a Regular Expression Denial of Service (ReDoS). The vulnerability is remotely exploit...

CVE-2025-5891: Inefficient Regular Expression Complexity

A vulnerability classified as problematic was found in Unitech pm2 up to 6.0.6. This vulnerability affects unknown code of the file /lib/tools/Config.js. The manipulation leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to th...

Basic-auth app bundle credential exposure in gatsby-source-wordpress

Impact The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected. Example affected...

GHSA-RQJW-P5VR-C695 Basic-auth app bundle credential exposure in gatsby-source-wordpress

Impact The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js are not affected. Example affected...

CVE-2021-32770 Basic-auth app bundle credential exposure in gatsby-source-wordpress

Gatsby is a framework for building websites. The gatsby-source-wordpress plugin prior to versions 4.0.8 and 5.9.2 leaks .htaccess HTTP Basic Authentication variables into the app.js bundle during build-time. Users who are not initializing basic authentication credentials in the gatsby-config.js a...

Design/Logic Flaw

DISPUTED Boa 0.94.13 allows remote attackers to obtain sensitive information via a misconfiguration involving backup.html, preview.html, js/log.js, log.html, email.html, online-users.html, and config.js. NOTE: multiple third parties report that this is a site-specific issue because those files ar...

PT-2019-20060

Name of the Vulnerable Software and Affected Versions mobile-icon-resizer versions prior to 0.4.3 Description The issue concerns a code execution vulnerability. It allows dynamic JavaScript payloads to be executed due to the ratio and baseRatio parameters being passed directly to eval. This...