CVE-2026-16981 DHL for WooCommerce < 4.0.1 - Unauthenticated Shipping Label Download via IDOR

The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check no capability, nonce, login, or ownership check on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequential ids and download every stored...

CVE-2026-16981

The DHL Shipping Germany for WooCommerce WordPress plugin, in versions prior to 4.0.1 , is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The application fails to perform essential authorization checks—such as capability, nonce, login, or ownership verification—on a specific shipp...

Malicious code in volna-boxy-di-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caad3654d755de84a91ca9afc1d7d393a1e2868b54b0b03020780b7878df28f8 On require, index.js loads compat.js which selects a platform-specific payload path, reconstructs C2 hostnames at runtime from split string fragments...

Malicious code in beaver-ui-card-large (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cddf97a67fa28e298f65b3f96b200109d5f15a8a6dde49b8bdd025e8052abf2 Package advertises itself as a React UI component library but index.js requires./setup.js, which schedules bootstrap on process.nextTick so the paylo...

CVE-2026-18907

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename...

CVE-2026-18907

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename...

CVE-2026-18907 PathTravelsal Vulnerability in com.talpa.hibrowser

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename...

CVE-2026-18907

The TECNO Hi Browser (com.talpa.hibrowser) version 2.23.1.1 on Android is vulnerable to a Path Traversal vulnerability (CWE-23) in its download file feature . The root cause is that the browser trusts an attacker-controlled Content-Disposition filename and fails to sanitize path separators or per...

EUVD-2026-53021

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename...

CVE-2026-18907 PathTravelsal Vulnerability in com.talpa.hibrowser

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename...

Malicious code in sso-tramvai-module-context-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2fe37796b442cbefe81da5d36efbb44744656e6ef3d34677ad4f6185f344d22 The package advertises itself as an auth-token handler but on require its index.js loads vendor.js, which reconstructs destination hostnames from arr...

MAL-2026-12073 Malicious code in sso-tramvai-module-context-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2fe37796b442cbefe81da5d36efbb44744656e6ef3d34677ad4f6185f344d22 The package advertises itself as an auth-token handler but on require its index.js loads vendor.js, which reconstructs destination hostnames from arr...

MAL-2026-12077 Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 65171e84f70bed8b30e494c9ab147abc3c26207ba7b3fb9ccf348cf8746867e4 The package's declared main entry index.js unconditionally requires./init on load. init.js assembles hardcoded remote hosts from split string fragmen...

Malicious code in sotqa-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6980ae2860be6b9f343e9705a5415dc9ea13a81d285c1dce1f2f56b3dc989fbd On require, sotqa-test loads bootstrap.js which reconstructs C2 hostnames from split-string arrays joined at runtime oob-worker.cf102-baf.workers.dev...

Malicious code in shopping-shared-atom-mobile-cart-counter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2e70575aedbdc1f873900c0d6f187183ba2cc4088a93caea3d71ab78dc1260 [email protected] loads loader.js from index.js at require time. loader.js assembles C2 hostnames at runtime via...

MAL-2026-12070 Malicious code in shopping-shared-atom-mobile-cart-counter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2e70575aedbdc1f873900c0d6f187183ba2cc4088a93caea3d71ab78dc1260 [email protected] loads loader.js from index.js at require time. loader.js assembles C2 hostnames at runtime via...

Malicious code in tinkoff-cache-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9db3a162bd8fe3b6112b6d058e42245617122a41941d0b3a818254aba25ce59b The package advertises itself as an in-memory cache utility, but index.js unconditionally requires compat.js on load, which acts as a dropper...

MAL-2026-12076 Malicious code in tinkoff-cache-path (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9db3a162bd8fe3b6112b6d058e42245617122a41941d0b3a818254aba25ce59b The package advertises itself as an in-memory cache utility, but index.js unconditionally requires compat.js on load, which acts as a dropper...

Malicious code in statist-browser-typed-client-nfs.grocery.mobile.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fcb1561dd1153104da17218a74c318e8d497b4df1429bbbda8cda0144bd06ce On require of the package's main entry, index.js transitively loads platform.js, which selects a platform-specific payload URL, fetches opaque...

Malicious code in bigops-customer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59163c2270e2c84a960164463cb31d73a8db2e80e484d7d58d44ed2d32d36f0a The package's main entry requires ./ext, which on load downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...