MAL-2026-12253 Malicious code in tinkoff-statist-browser-typed-client-art.apps.reporegistry (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d935ce8eda3349f3633b3ab3c55baa492821164fbdb291bc942863d3aac4d4c1 On require of the package, adapter.js executes a top-level bootstrap that downloads a platform-specific binary from hardcoded Cloudflare Workers host...

Malicious code in tinkoff-fb-rf-add-application (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 788686e9aacdc59ec40f42563a7d9ba5020c75d6c724c8bf59623213b51df780 The package's main entry loads bootstrap.js on require, which downloads a platform-specific executable from string-fragment-obfuscated...

Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.dynamicteasers.common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd094a1c3c67af1fc7372e62ed565847fcf26962f3b90e53a5df200390c07a99 On require/import, index.js loads bridge.js which selects a platform-specific endpoint and downloads an opaque executable over HTTPS from hardcoded...

MAL-2026-12185 Malicious code in pfa-autotests-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0d767d6c21c9a23c7190f1479b572e85e1c257f1786c96c76c8029c8169b4fd On require, pfa-autotests-reporter loads adapter.js which selects a platform-specific path, fetches a binary over HTTPS from one of four Cloudflare...

MAL-2026-12186 Malicious code in pfp-forms-insurance-health (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dd718d214c6718fcbfa156788040734ad3dee63b06a5b72737ec099f64e0b96 On require'pfp-forms-insurance-health', index.js loads compat.js which immediately invokes a dropper routine. It selects a per-OS asset path, downloa...

Malicious code in peter-desktop-peter-big-column (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7593cd2f0f03765e6debc06626ee5d771a32e0d7eb579ddca1bfc5ca53bc22e6 On require, index.js loads runtime.js which assembles download hostnames at runtime from split string fragments resolving to...

EUVD-2026-53174

The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amdajaxtargettaskmanager function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all...

MAL-2026-12073 Malicious code in sso-tramvai-module-context-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2fe37796b442cbefe81da5d36efbb44744656e6ef3d34677ad4f6185f344d22 The package advertises itself as an auth-token handler but on require its index.js loads vendor.js, which reconstructs destination hostnames from arr...

Malicious code in tinkoff-component-infopanel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1465530b7853077d8b3fb7896478a69f62f6506df775d2e959b3d9bae6861f11 On require of the package, platform.js downloads a platform-specific native binary from hardcoded Cloudflare Workers hosts...

CVE-2026-6079: Missing Authorization

The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amdajaxtargettaskmanager function in all versions up to, and including, 1.4.10. This makes it possible for unauthenticated attackers to enumerate all...

Malicious code in vitest-preview-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 367fd88886da38fc8a88929cfb486d6031ee42d44499b5f7a2d47d4e91d5b075 The package is published under a name suggesting a Vitest preview utility, but the shipped code is a rebranded copy of nodemailer with an added...

Malicious code in hubert-application-get-document-preview-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5e887ef3c3509ebfe43d231ff354e4e0d7f8eb20c9da05389324446d44fc589 On require of the package, index.js loads setup.js which selects a platform key, downloads a native binary from one of four hardcoded workers.dev...

MAL-2026-11550 Malicious code in twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e60e623d29b1989a7cbce00ae577fdcbe27d82d33a7f2f8c03ffe52b317f4f8 On require of the package, index.js loads compat.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

Malicious code in twork-data-services-aggregator-api-v2-data-view-company-company-profile-mf-data-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e60e623d29b1989a7cbce00ae577fdcbe27d82d33a7f2f8c03ffe52b317f4f8 On require of the package, index.js loads compat.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

EUVD-2026-52869

SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3...

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

NPM: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode nodeVMOptions Override vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...

EUVD-2026-52742

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...

CVE-2026-69254

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.ts. An authenticated attacker reaching...

CVE-2026-67243

freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands...