MAL-2026-13511 Malicious code in dolyame-ui-stateutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdcb488491701865d9106e75e576785ff3b4f1d9687e456eb69f1ff69d8a393f On require/import, index.js loads loader.js which fetches an opaque platform-specific binary from one of three obfuscated Cloudflare Workers endpoint...

Malicious code in dolyame-ui-stateutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cdcb488491701865d9106e75e576785ff3b4f1d9687e456eb69f1ff69d8a393f On require/import, index.js loads loader.js which fetches an opaque platform-specific binary from one of three obfuscated Cloudflare Workers endpoint...

Apache Thrift: Python TSSLSocket Hostname Matcher Import

...

EUVD-2026-54292

A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service...

PT-2026-69141

Name of the Vulnerable Software and Affected Versions Pathling Server versions prior to 2.0.0 Description The $import-pnp operation accepts a caller-supplied exportUrl and uses it as the remote FHIR Bulk Export endpoint without constraining it to a trusted source. When PNP credentials are...

CVE-2026-7405

A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service...

CVE-2026-49391

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...

CVE-2026-49391

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...

EUVD-2026-54175

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...

CVE-2026-49391 Frappe: Stored XSS in Column Headers via Data Import

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...

CVE-2026-49391 Frappe: Stored XSS in Column Headers via Data Import

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...

CVE-2026-49391 Frappe: Stored XSS in Column Headers via Data Import

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This...

CVE-2026-49391

CVE-2026-49391 affects Frappe framework’s Data Import feature. Before versions 16.19.0 and 15.109.0, imported column headers were not escaped when rendering previews/results, enabling an authenticated user to persist script content that executes when another user views the import interface (Store...

MAL-2026-13454 Malicious code in poc-ch4rlygr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 341e5cb63d816ed6a8ed092f3b174e9826e10d051d8e78a53f0564b1437d0e04 On require/import, index.js collects os.hostname, os.arch, dirname, os.userInfo.username, and the full contents of process.env serialized via...

Malicious code in poc-ch4rlygr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 341e5cb63d816ed6a8ed092f3b174e9826e10d051d8e78a53f0564b1437d0e04 On require/import, index.js collects os.hostname, os.arch, dirname, os.userInfo.username, and the full contents of process.env serialized via...

CVE-2026-7405 TIF File Parsing Out-of-Bounds Read in certain Autodesk products

A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service...

CVE-2026-7405 TIF File Parsing Out-of-Bounds Read in certain Autodesk products

A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service...

CVE-2026-7405

A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service...

CVE-2026-18359

Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the metsuri or iiifuri parameter o...

Malicious code in alphalend-abi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1650b24020e22aac89835e5b8a20b7de20f6479a2ce311d35dd56ab3dc4d6bb1 During import, the package exfiltrates sensitive files with SUI private keys to a private GitHub repository. This action is also triggered on every Python...