Malicious code in @itsreduxtm/unpkg-xss-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39614132e3675ec887b41aa6834ac54cce90e248d43f008345444b86e1870d82 payload.js is declared as the package main and runs an IIFE immediately on require/import. It fetches a wordlist of Linux binary names from...

Malicious code in content-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5656ce6bbda8526587e40810d90b3188e11d507ebb13168203384bfac6b5ec1b [email protected] declares a preinstall lifecycle script in package.json that executes node -e to perform an HTTP GET to a unique subdomain of...

MAL-2026-13430 Malicious code in @ch4acko3/frontal-lobe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b73f6f94b2fcc3ef2aabd490862d743e9722f891d2c41421b1352dc318294585 The package hardcodes the endpoint http://47.112.15.137:8789/frontal/trace-sync bare IPv4, plain HTTP in...

Over 4,400 Rockwell PLCs Exposed Online, 22 Found in Water Attack Cities

Forescout found 22 internet-facing Rockwell Automation programmable logic controllers PLCs in cities hit by recent cyberattacks on US water utilities. Nineteen used the same mobile carrier network. Its August 3 scan counted 4,407 exposed Rockwell controllers worldwide, including 2,844 in the Unit...

Apple iCloud Private Relay Can Expose Real IPs Through WebKit Proxy Bypasses

Cybersecurity researchers have disclosed a security issue with Apple's iCloud Private Relay tool that can expose a user's real IP address. Introduced with iOS 15, iCloud Private Relay employs a dual-hop architecture to ensure users' privacy by routing their Safari web traffic through two relays s...

SUSE CVE-2026-64569

In the Linux kernel, the following vulnerability has been resolved: mpls: fix NULL deref in mplsvalidfibdumpreq on CONFIGINET=n On CONFIGINET=n builds, mplsvalidfibdumpreq walks the parsed attribute table itself instead of calling ipvalidfibdumpreq. The RTAOIF arm passes tbRTAOIF to nlagetu32...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

CVE-2026-13342: Protection Mechanism Failure

The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeati...

JLSEC-2026-1165 Deno: WebSocket API sandbox bypass via missing post-DNS check

Summary When a WebSocket connection was opened, Deno checked the destination hostname against --deny-net rules but did not re-check the IP addresses that hostname resolved to. An attacker-controlled script could use a specially crafted domain name that passes the hostname check yet resolves to a...

CVE-2026-9081

IBM Langflow OSS 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 contains a Server-Side Request Forgery SSRF vulnerability in the validatemodelproviderkey function for the Ollama provider. The function accepts a user-supplied OLLAMABASEURL parameter and passes it directly to requests.get without...

SSRF (Server-Side Request Forgery) ip-address Dependency in Jira Service Management Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in versions 11.2.0 and 11.3.0 of Jira Service Management Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.7 and a CVSS Vector of...

ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

SSRF (Server-Side Request Forgery) ip-address Dependency in Jira Software Data Center

This High severity SSRF Server-Side Request Forgery vulnerability was introduced in versions 11.2.0 and 11.3.0 of Jira Software Data Center. This SSRF Server-Side Request Forgery vulnerability, with a CVSS Score of 7.7 and a CVSS Vector of...

CVE-2026-69192

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

CVE-2026-69198

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IP addresses. By appending a Classless Inter-Domain Routing CIDR suffix to an IP address, an attacker can bypass the library's special-use classification methods. This misclassification can lead applications, such a...

CVE-2026-71271

Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does...

MAL-2026-12671 Malicious code in dc-renewals-layout2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6219fbfa414c89e001a734c3cdebf2c059981f1777c937f513198c21e3cbd113 The package's preinstall script auto-runs on npm install and issues a plaintext HTTP GET to http://75.119.137.232:31337/depconfuse carrying the...

Malicious code in break-after (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80e06e591fd35c119051df59a1ed1771e74146adb37f3aef05367812412af1ad The package's preinstall script runs automatically on npm install and collects os.hostname, os.userInfo.username, process.cwd, the configured npm...

Malicious code in shiftmarkets-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1628a8b4e8b6c4c117f2a38f7d69664950c1d5758772c64c2225f296f681c29 The package declares a postinstall hook that runs dist/recon.js on npm install. The script collects hostname, username, sudouser, homedir, cwd,...

MAL-2026-12803 Malicious code in shiftmarkets-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1628a8b4e8b6c4c117f2a38f7d69664950c1d5758772c64c2225f296f681c29 The package declares a postinstall hook that runs dist/recon.js on npm install. The script collects hostname, username, sudouser, homedir, cwd,...