MAL-2026-14043 Malicious code in @divineubg/divine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52dc0a48d6e7e18ff3bb09306aa6d4c17aefff323b1f86b84f19197ba4a094be index.js exports a listenclientId function that subscribes to https://ntfy.sh/dv-141u30-admin-cmd-/sse via EventSource and, on receiving messages wit...

CVE-2026-59803

creationtimestamp| type| source ---|---|--- 2026-07-08 22:02:26+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq64ouacqi2t 2026-07-09 00:15:02+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-59803...

PT-2026-51104

Name of the Vulnerable Software and Affected Versions @tinacms/app versions prior to 2.5.6 tinacms versions prior to 3.9.3 Description Cross-origin postMessage handlers allow for stored XSS and session takeover. The software registers window message listeners—specifically the useTina overlay...

CVE-2026-44214

eventsource-encoder encodes events as well-formed EventSource/Server Sent Event SSE messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Event...

CVE-2026-44214 eventsource-encoder: SSE event injection via unsanitized event and id fields

eventsource-encoder encodes events as well-formed EventSource/Server Sent Event SSE messages. Prior to 1.0.2, eventsource-encoder does not sanitize the event or id fields of an EventSourceMessage before serializing them. An attacker who controls either field can inject arbitrary Server-Sent Event...

CVE-2026-44668

creationtimestamp| type| source ---|---|--- 2026-05-26 19:28:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmrq2hvnlt2p...

CVE-2026-46431

CVE-2026-46431 affects Algernon’s SSE event server prior to version 1.17.7, where Access-Control-Allow-Origin was hardcoded to “*”. This allowed cross-origin EventSource connections to read the live filename stream, compromising confidentiality. The issue is fixed in 1.17.7; upgrading to that ver...

GHSA-HW27-4V2Q-5QFF Algernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *

Summary The SSE event server's Access-Control-Allow-Origin response header was hardcoded to the wildcard regardless of the caller's Origin. Because EventSource does not preflight and does not send cookies, the wildcard is sufficient to let any third-party page the developer visits open a...

CVE-2018-25314

creationtimestamp| type| source ---|---|--- 2026-04-29 20:25:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknwnpzlsb2o 2026-04-29 20:39:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mknxfzyb4u2c...

CVE-2026-40002

creationtimestamp| type| source ---|---|--- 2026-04-17 10:09:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjools7oae2f...

PT-2026-25030

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. Prior to 0.50.1, in a situation where the ring-buffer of a gadget is – incidentally or maliciously – already full, the gadget will silently drop events. Th...

CVE-2026-28486

creationtimestamp| type| source ---|---|--- 2026-03-06 02:04:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mge7w4w5mz2u...

CVE-2025-67850

creationtimestamp| type| source ---|---|--- 2026-02-03 13:16:27+00:00| seen| Telegram/fpMcrY2RALMfsN1onUqQsHu7uTJCJuSmLnazyi9cvEQogc...

CVE-2020-3644

creationtimestamp| type| source ---|---|--- 2026-01-20 08:05:01+00:00| seen| https://infosec.exchange/users/certvde/statuses/115926387351405846...

CVE-2025-13493

creationtimestamp| type| source ---|---|--- 2026-01-07 09:51:32+00:00| seen| https://gist.github.com/Darkcrai86/a7cb2e3df0a8f8a1eed221eaa235d11a 2026-01-07 18:09:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mbu2sgcer72e...

CVE-2025-49712

creationtimestamp| type| source ---|---|--- 2025-08-12 16:01:32+00:00| seen| https://www.thezdi.com/blog/2025/8/12/the-august-2025-security-update-review 2025-08-13 10:48:37+00:00| seen| https://t.me/truesecator/7322...

CVE-2025-4077

creationtimestamp| type| source ---|---|--- 2025-04-29 18:12:22+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13885 2025-04-29 19:50:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lny2ilcvx62p 2025-04-29 21:01:05+00:00| seen|...

CVE-2025-32445 Users can gain privileged access to the host system and cluster with EventSource and Sensor CR

Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges. The EventSource and Sensor...

Privilege Chaining

Overview Affected versions of this package are vulnerable to Privilege Chaining through the spec.template.container configuration in the EventSource and Sensor custom resources. An attacker can gain privileged access to the host system and cluster by injecting commands into a container template...

Privilege Chaining

Overview Affected versions of this package are vulnerable to Privilege Chaining through the spec.template.container configuration in the EventSource and Sensor custom resources. An attacker can gain privileged access to the host system and cluster by injecting commands into a container template...