PT-2026-68391

Name of the Vulnerable Software and Affected Versions Tourmaster versions prior to 5.4.9 Description An issue exists where the plugin writes order and booking exports to a fixed, predictable file within a publicly accessible directory. Due to a lack of access control, unauthenticated users can...

Malicious code in dolyame-boxy-desktop-bnpl-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bdd69d6a0625e30b3c7764f12685db79bacb5c01e092772a38bbd7019addf54 Requiring dolyame-boxy-desktop-bnpl-footer causes platform.js to execute at load time: it reconstructs destination hostnames from split string arrays...

Malicious code in dolyame-ui-input (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9361a45d107dd4fff2e6928df78c74829cdb1e0c49f6fe513c60124331f8242 [email protected] is published as a React component library but ships no UI code. On require, index.js loads shim.js, which downloads a...

Malicious code in dws-frontend-dws-frontend-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb73f65c18cf45f29f533ef6b9ab1278412909686c0750018f9d35170ed39f2 On require of this package, index.js loads support.js which downloads a platform-specific binary over HTTPS from author-controlled hosts under...

Malicious code in bnpl-blocks-desktop-bnpl-action-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a42e260d378e0b517e59b4656f10bb75ffe083a5f8431b4d6a908ec4dae0cb0 On require of the package's main entry, compat.js reconstructs Cloudflare Workers hostnames oob-worker.cf103-070.workers.dev,...

Malicious code in boxy-live (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2804acf2e6e6e87de8651cf13574290daa1a3a59bb556d8f225d2d6d2abd8783 On package load, index.js requires loader.js, whose top-level start fetches a platform-specific unsigned binary from Cloudflare Workers hosts whose...

Malicious code in bpm-foundation-linters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7753fe48a070f467d11a5dfef041b6919ff9914df1484d0ef0e59c95f583961 On require of the package, index.js loads runtime.js which selects a per-platform payload path, fetches an opaque binary over HTTPS from one of three...

Malicious code in checkout-mobile-input-email (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9c13bf58568e58ecec010552f23cd8eb27cef188f4ed0c905e832fa0f8d0372 On require'checkout-mobile-input-email', index.js loads helpers.js which assembles hostnames via string-array.join"" e.g...

MAL-2026-12593 Malicious code in checkout-storybook-default (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844d8b490d431f2fad501a06bbcf924fe5890ba16c92157dd52488c1908f7909 On require of the package, index.js loads polyfill.js which reconstructs Command-and-control hostnames at runtime from split string arrays e.g...

MAL-2026-12626 Malicious code in claims-is-mobile-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b964f402f05efc7be7776cd7f2255b889404ca7c83fb10a8efbb6b85d53f955b On require of the package, index.js unconditionally loads./vendor.js, which selects a platform-specific endpoint, downloads a native binary over HTTP...

MAL-2026-12660 Malicious code in constructor-blocks-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96701ff9ef8e8d7ed9b946a9cb3cc7efa18a6159a1729610892fb95dc6175c31 On require of constructor-blocks-common, index.js loads helpers.js which invokes a bootstrap routine at module load. The routine reconstructs...

MAL-2026-12704 Malicious code in devplatform-cli-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bb41284069ba395bf67ceb847dc579c7a79c753ea89107116e91559ebbece2a On require'devplatform-cli-spa', index.js loads support.js which selects a payload by OS and architecture, downloads a native binary over HTTPS from...

CVE-2026-71279 Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution

Zigbee2MQTT's ExternalJSExtension.getFilePath lib/extension/externalJS.ts joins a parameter received via an MQTT message topic zigbee2mqtt/bridge/request/extension/save into the extensions base path using path.joinbasePath, name with no sanitization. The extension handler only validates that the...

EUVD-2026-53344

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py: if parsed.scheme and parsed.netloc or parsed.scheme == "file": return parsed.geturl. Because and binds tighter than or, any file: URI passes validation regardless of netloc. Th...

MAL-2026-12259 Malicious code in tinkoff-statist-browser-typed-client-eventea.projects.finhealthwebmicroblocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d381f80d9b2d3b310ab426d3c51996861b4c320f2926e53ea078da80e832a07 On require of this package, index.js loads vendor.js which downloads a platform-specific binary from runtime-assembled Cloudflare Workers hostnames...

MAL-2026-12185 Malicious code in pfa-autotests-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0d767d6c21c9a23c7190f1479b572e85e1c257f1786c96c76c8029c8169b4fd On require, pfa-autotests-reporter loads adapter.js which selects a platform-specific path, fetches a binary over HTTPS from one of four Cloudflare...

MAL-2026-12305 Malicious code in twork-products-taiga2-products-investment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64ab6e4ef4d1c4dafd75af4c52d747069dd76fa1ba8d958f2c82ba7fba2e8a0 On require of the package, init.js unconditionally loaded from index.js fetches a platform-specific executable from one of three obfuscated Cloudflar...

Malicious code in specials-obid-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef5ac97b682821ce99ff6152a28467cd5ec91903d061ba1fc70ef7a3e6b9be03 On require of the package, vendor.js selects a URL path by host platform, downloads a binary over HTTPS from destination hostnames assembled at runti...

Malicious code in tinkoff-terminal-kit-carousel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d67091b6d7ee752850793817e0bf77d92b3bc16bff12d5348e81c1cb39cf6423 On require of the package, index.js loads adapter.js, which selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of thr...

EUVD-2026-52668

External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality. This issue affects pardus-image-writer: before 1.0.4...