MAL-2026-13717 Malicious code in @sqlite-table/schema-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4db5d5f6801c8d18fb40f84808a299ea8d8e251da32260b4fbf264a290f44e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @sqlite-table/schema-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4db5d5f6801c8d18fb40f84808a299ea8d8e251da32260b4fbf264a290f44e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2026-54938

A vulnerability was identified in Ichigo3766 image-gen-mcp 0.1.0. The impacted element is an unknown function of the file src/index.ts of the component upscaleimages. Such manipulation of the argument outputpath leads to path traversal. The attack must be carried out locally. The project was...

CVE-2026-19338

A vulnerability was identified in automateyournetwork MCPyATS up to 0.1.4. The affected element is the function processGenerateRequest of the file mcpservers/mermaid/index.ts of the component generatemermaidmarkdown. The manipulation of the argument folder/name leads to path traversal. The attack...

CVE-2026-14526

The AI Copilot – Content Generator plugin for WordPress is affected by an authorization bypass vulnerability in all versions up to and including 1.5.6. The issue arises because the plugin does not properly verify a user’s authorization to perform certain actions, enabling unauthenticated attacker...

readme2demo v0.8.0

readme2demo — verified tutorials & demo videos from your README ▶ readme2demo generating its own tutorial: an AI agent runs this repo's README in a sandbox, a fresh container replays every step, then the demo is rendered. Full self-run output in examples/readme2demo · run against another project ...

CVE-2026-14526: Improper Privilege Management

The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to creat...

CVE-2026-71851

crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random, instead of a cryptographically secure source...

CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps

Coinspect has identified CryptoJS.lib.WordArray.random as the weak random number generator behind the Ill Bloom wallet drains. Introduced in the JavaScript cryptography library 12 years ago, the function supplied weak entropy that affected wallet apps used to generate recovery phrases. Coinspect'...

PT-2026-68569

Name of the Vulnerable Software and Affected Versions AI ANN versions prior to 1.29.1 Description The AI ANN - AI Generator & AI Agency WordPress Theme is subject to PHP Object Injection due to the deserialization of untrusted input. This allows unauthenticated attackers to inject a PHP Object...

CVE-2026-8470

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for...

EUVD-2026-53549

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for...

MAL-2026-13345 Malicious code in hd-key-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a102f1d05a0bd89af765e457c2b5d6121ec831d33549d0cbf9795d58b0d3ee6 hd-key-generator is a typosquat of the hdkey package. On require, index.js reads process.env, os.hostname, os.userInfo.username, the user's home...

Malicious code in bip39-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec957684e0430a139485e6eacb410980ada8b9c9e90c0ba3c6909472f1557339 On module load, index.js JSON-serializes the full process.env together with hostname, username, homedir, platform, and cwd, base64-encodes the blob,...

Malicious code in bnpl-blocks-data-schema-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1e39c2d94a6114333c4275444d786188f00056a96e6e6296cd3abf275e3d5bc index.js unconditionally requires bootstrap.js, which on module load reconstructs Cloudflare Workers subdomains oob-worker.cf10x-xxx.workers.dev and...

MAL-2026-12731 Malicious code in devplatform-po-declaration-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3270e0e94deb3e2573594f28e84026653ee60f6c7f0a1fb79286ebba811ca525 On require, index.js unconditionally loads init.js, which selects a platform-specific binary for linux/darwin/win32, downloads it from Cloudflare...

WordPress AI Copilot – Content Generator plugin <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability

Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability discovered by Kazuma Matsumoto in WordPress Plugin AIWU versions = 1.4.6...

MAL-2026-12121 Malicious code in @zzzgenesis00/hd-key-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d1bce1ae0778169c4e5fb37721dfcc052c984efc60a257166adb4d20e2d39e5 @zzzgenesis00/hd-key-generator ships a postinstall.js that runs automatically on npm install. It enumerates /.ssh, /.npmrc, /.gitconfig, browser...

Malicious code in @wethenorth12/hd-key-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b2e832840746236ecbc71ba886ec793620dd508cd2a75eca04bd44e575cb03b @wethenorth12/hd-key-generator markets itself as a drop-in replacement for the popular hdkey wallet library. On require, index.js reads the full...

MAL-2026-12095 Malicious code in @wethenorth12/hd-key-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b2e832840746236ecbc71ba886ec793620dd508cd2a75eca04bd44e575cb03b @wethenorth12/hd-key-generator markets itself as a drop-in replacement for the popular hdkey wallet library. On require, index.js reads the full...