EUVD-2026-74843

GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution...

DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS

Summary In INPLACE mode DOMPurify sanitizes the caller's live DOM subtree directly. To close a known hazard GHSA-55q2-fjhq-7xh7, the library neutralizes any node a hook detaches during sanitization by stripping its subtree's non-allow-listed attributes, but this neutralization is wired only into...

GHSA-P98J-92PF-MC4P DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS

Summary In INPLACE mode DOMPurify sanitizes the caller's live DOM subtree directly. To close a known hazard GHSA-55q2-fjhq-7xh7, the library neutralizes any node a hook detaches during sanitization by stripping its subtree's non-allow-listed attributes, but this neutralization is wired only into...

Exploit for CVE-2026-102973

CVE-2026-102973: API email authorization hook bypass Reporter...

Malicious code in booking-eligibility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c93f5b06720659d8e0cc8efb7d6bd75f577605e84c27cfb600a795081c27654 package.json declares a postinstall lifecycle hook wscript.exe 4444.vbs that runs Windows Script Host against a .vbs file on npm install. The...

MAL-2026-17316 Malicious code in booking-eligibility (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c93f5b06720659d8e0cc8efb7d6bd75f577605e84c27cfb600a795081c27654 package.json declares a postinstall lifecycle hook wscript.exe 4444.vbs that runs Windows Script Host against a .vbs file on npm install. The...

Malicious code in booking-tasks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08305a6c73bd94f2983c949316cb78fef7f7169f85523a773c94fb305874e063 The package's package.json declares a postinstall hook wscript.exe 4444.vbs that fires automatically on npm install. The bundled 4444.vbs contains...

MAL-2026-17317 Malicious code in booking-tasks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08305a6c73bd94f2983c949316cb78fef7f7169f85523a773c94fb305874e063 The package's package.json declares a postinstall hook wscript.exe 4444.vbs that fires automatically on npm install. The bundled 4444.vbs contains...

MAL-2026-17314 Malicious code in test-supply-npm-lib-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44f10381ad047460986bbeedafad42f8c71db61fff98fe07c915cd0d3678d268 package.json declares a dependency sourced from a git URL git+https://[email protected]/agustedone/test-supply-npm-git-prepare-proof-4.git pinned to...

AlmaLinux 9.2 [TuxCare] Security Update: cloud-init Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1760018787)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1760018787 advisory. - cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666...

AlmaLinux 9.2 [TuxCare] Security Update: oci-seccomp-bpf-hook (ALMALINUX9.2:CLSA-2026:1784707996)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784707996 advisory. - When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash...

Malicious code in @rutxploit-sec/waves-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdeb076eee35958fd0520e7f9cca9d361c47f02cb81c73288609ecdfb60bdbb1 @rutxploit-sec/waves-icons is a dependency-confusion proof-of-concept squatting the internal scope name @waves/icons. Its package.json declares a...

MAL-2026-17291 Malicious code in @rutxploit-sec/waves-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdeb076eee35958fd0520e7f9cca9d361c47f02cb81c73288609ecdfb60bdbb1 @rutxploit-sec/waves-icons is a dependency-confusion proof-of-concept squatting the internal scope name @waves/icons. Its package.json declares a...

Malicious code in fabric-loader-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a11b2ce0f9b1a7b7587acd21c631a72069bab0216c8bf010f4fb04f8b0ae543f The package's postinstall hook runs index.js, which performs an HTTPS GET to the hardcoded host https://fabric-npm.gm-service.xyz/p and passes the...

MAL-2026-17306 Malicious code in fabric-loader-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a11b2ce0f9b1a7b7587acd21c631a72069bab0216c8bf010f4fb04f8b0ae543f The package's postinstall hook runs index.js, which performs an HTTPS GET to the hardcoded host https://fabric-npm.gm-service.xyz/p and passes the...

Malicious code in @hrmony/kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6976b2f9327b9a181d77cd0597ef2f657575961a3d47ef8c57de1f6d4141503d On require/import, index.js contacts the EC2 Instance Metadata Service at 169.254.169.254 using an IMDSv2 token, enumerates the instance's IAM role...

MAL-2026-17263 Malicious code in @hrmony/kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6976b2f9327b9a181d77cd0597ef2f657575961a3d47ef8c57de1f6d4141503d On require/import, index.js contacts the EC2 Instance Metadata Service at 169.254.169.254 using an IMDSv2 token, enumerates the instance's IAM role...

Malicious code in @hrmony/kit-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6ac778d35433101385eb57755b6079e76c7bb3dc40306218cf5b1295d5a853 The package runs credential-harvesting code both at install time and at import time. The declared preinstall hook scripts/check-setup.mjs queries the...

MAL-2026-17265 Malicious code in @hrmony/kit-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6ac778d35433101385eb57755b6079e76c7bb3dc40306218cf5b1295d5a853 The package runs credential-harvesting code both at install time and at import time. The declared preinstall hook scripts/check-setup.mjs queries the...

Malicious code in xeprews (npm)

The package xeprews impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...