Malicious code in dolyame-boxy-desktop-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945 On require of the package, runtime.js selects an OS/arch-specific payload linuxx64, linuxarm64, darwin, win32, downloads a binary from...

CVE-2026-16102

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

CVE-2026-15572

A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...

CVE-2026-15572

CVE-2026-15572 (Keycloak) affects Keycloak’s Dynamic Client Registration (DCR) policy management. The bug is in the "Allowed Protocol Mapper Types" policy: during a client update, if the mapper’s configuration doesn’t change, re-validation of the mapper type is skipped, enabling an attacker with ...

CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation

A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...

CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation

A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...

EUVD-2026-53398

A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...

MAL-2026-13266 Malicious code in devplatform-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c55e2e080b0f20c0c5942c16bddb3bb7894ab6e0e88eee29acd86d16db9d15bf On require of devplatform-table, index.js loads./compat which selects a platform-specific payload path, downloads an executable from...

Malicious code in beaver-ui-pagination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2db8f562892f21caf2a12230c52507a333a5ada223f98964094838657072adcb On require'beaver-ui-pagination', index.js loads init.js which selects a platform key and downloads a binary from string-split-obfuscated hosts...

Malicious code in bigops-telephony-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93b10fc5eff860f82de5bc03b910dbe2b96b06d54c22741cbb593b007dd9ee38 On require of the package, shim.js downloads a platform-specific executable over HTTPS from string-concatenated hostnames...

MAL-2026-12819 Malicious code in beaver-ui-object-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a2a78be16248a4269fca22b39cf436f82f26818c797949af73eca331cc3a0f6 On require'beaver-ui-object-card', index.js loads ext.js which selects a platform-specific asset path and downloads an unsigned native binary from...

MAL-2026-12853 Malicious code in bigops-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36dcb322eace39209bb0092ab7ea7c658481887a48eff948f116bfb7909ec131 Loading the package's main entry point auto-invokes helpers.js init, which downloads an OS-specific binary from obfuscated Cloudflare Workers...

MAL-2026-12857 Malicious code in bigops-watermark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1eba25818a15259edb9be7c7629e7319599a0ba7ac7a665f976c78ffb1e56f3 On require of the package, index.js unconditionally loads support.js, whose init runs at module load. It selects a platform-specific endpoint, fetche...

Malicious code in bnpl-blocks-atom-bnpl-search-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f6cce4434c5b69e3ce6547672267cf91a8d243e9970fe13b9b669e7f7a7b91b On require, bridge.js fetches a platform-specific binary from string-split-obfuscated Cloudflare Workers hosts oob-worker.cf103-070.workers.dev,...

MAL-2026-12695 Malicious code in devplatform-api-v2-resource-mock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cde262833260cbba75c5fdd2160e0f91a6c43c0f7ad202b44475c649772c1174 [email protected] is an import-time dropper. The package's main entry index.js requires compat.js, which on load assembles C2...

CVE-2026-16102

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

CVE-2026-16102

Keycloak-DCR: The default Dynamic Client Registration policy allows forging roles via User Property mappers due to insufficient claim-path validation. This enables a standard-user with a limited Initial Access Token to write to sensitive internal claim locations, forging administrative roles in t...

CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

EUVD-2026-53382

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...