Malicious code in aria-live-region-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 391a9a163273e36e3945f918ea720b8e10aa462b0aa603d4012b28c557c58570 The package is advertised as an ARIA accessibility helper but ships thunderboltRegistry.js, which executes a top-level IIFE on module load. The IIFE...

Malicious code in minimal-a11y-contrast-check (npm)

Source: amazon-inspector d9a198e6fb2c5e31bc841ff12f210e630abe8629853faf4ea961a124a9be8a25 Despite being advertised as a WCAG contrast checker, the package executes a self-invoking function at module load that runs host reconnaissance commands whoami, id, hostname, uname -a, ls -la /, pwd, cat...

MAL-2026-17514 Malicious code in minimal-a11y-contrast-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9a198e6fb2c5e31bc841ff12f210e630abe8629853faf4ea961a124a9be8a25 Despite being advertised as a WCAG contrast checker, the package executes a self-invoking function at module load that runs host reconnaissance...

MAL-2026-17517 Malicious code in popover-anchor-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31e270ae326e5c45ebeb5fcf7bc9ff96126908c194bef5f280a4028fff0e9ed9 The package advertises itself as a 'popover anchor positioning polyfill' but ships thunderboltRegistry.js, which executes an IIFE on module load that...

CVE-2026-58415

A flaw was found in the moddavfs module of the Apache HTTP Server. A remote attacker can exploit this vulnerability by sending an HTTP GET request directly to the internal WebDAV Web Distributed Authoring and Versioning state directory. This allows unauthorized access to internal state files,...

djust has broken object-level access control (IDOR)

Impactdjust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated us...

PYSEC-2026-4041 djust has broken object-level access control (IDOR)

Impact djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA urlchange navigation, and c % liverender % embedded child views. An authenticated...

CVE-2024-3273-EXPLOIT

CVE-2024-3273 - D-Link Remote Code Execution RCE 💥 A critical vulnerability, classified as CVE-2024-3273, was discovered in several D-Link NAS devices, including DNS-320L, DNS-325, DNS-327L, and DNS-340L, up to the date of 20240403. This vulnerability affects an unknown function of the file...

PT-2026-105798

Impact djust's per-object authorization get object + has object permission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry points: a the initial HTTP GET render, b SPA url change navigation, and c % live render % embedded child views. An...

Malicious code in @rutxploit-sec/waves-icons (npm)

Source: amazon-inspector bdeb076eee35958fd0520e7f9cca9d361c47f02cb81c73288609ecdfb60bdbb1 @rutxploit-sec/waves-icons is a dependency-confusion proof-of-concept squatting the internal scope name @waves/icons. Its package.json declares a preinstall lifecycle hook that runs inline Node code node -e...

MAL-2026-17288 Malicious code in @rutxploit-sec/subsplash-canny (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1ebadea2eb63a0fc7cf7446e36a589c5b87fc7d28e68b68145b98577107ebb npm package @rutxploit-sec/subsplash-canny declares a preinstall lifecycle script that runs node -e inline code reading os.hostname and...

Malicious code in @rutxploit-sec/waves-button-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 435937e521ca52ff4d99fd276136aff40364c4a88a3a4677cecf390c9d9bb600 @rutxploit-sec/[email protected] auto-executes host-identifier exfiltration on both npm install and require. package.json declares a preinstall...

CVE-2026-100696

Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery SSRF vulnerability in the optional Elasticsearch driver plugins/drivers/elastic.php, fixed in 6.0.2. Because adminer/include/auth.inc.php invokes Driver::connect before the login result is validated, an...

CVE-2026-86066 Horilla attendance approval endpoint is vulnerable to cross-site request forgery

Horilla is an HR and CRM software. Prior to 2.0.0, approvevalidateattendancerequest at /attendance/approve-validate-attendance-request/ changes attendancevalidated, isvalidaterequestapproved, approvedby, and related pending-request state through an HTTP GET before calling attendance.save, so Djan...

PT-2026-98996

Milvus through 2.6.22 and 3.0.0 contains an unauthenticated denial of service vulnerability that allows remote attackers to terminate service components by sending a crafted HTTP GET request to the management server on port 9091. Attackers can exploit the unprotected /management/stop endpoint,...

Malicious code in test1hh235 (npm)

Source: amazon-inspector c9c95dc5aea7805ca50e114bae45747a46edb7331311044b0d3730e303d4351a Package declares both preinstall and postinstall lifecycle hooks that execute index.js on npm install. index.js issues an HTTP GET to the hardcoded bare IP 128.199.122.145 over plain HTTP, embedding the...

Malicious code in test1gg234 (npm)

Source: amazon-inspector dd57f799e0797ede7d18d6a36dd05c31c34d21b4e45d554730a8d08dd310cf73 The package declares both preinstall and postinstall lifecycle hooks that execute index.js, which issues a plaintext HTTP GET to the hardcoded bare IP 128.199.122.145 with the package name in the query strin...

CVE-2026-61596

djust , a Django library providing Phoenix LiveView-style reactive server-side rendering with Rust-powered performance, had a broken object-level access control (IDOR) flaw prior to version 1.0.7 . Per-object authorization (get_object + has_object_permission) was enforced on WebSocket mount and e...

CVE-2026-61596

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization "getobject" + "hasobjectpermission", ADR-017 was enforced on the WebSocket mount and event paths but not on three other render...

CVE-2026-61596 djust has broken object-level access control (IDOR)

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization getobject + hasobjectpermission, ADR-017 was enforced on the WebSocket mount and event paths but not on three other render entry...