8696 matches found
Malicious code in dolyame-ui-contextmenusearchable (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 391ae77ec9b34917f01d44186bbafde2f290fc34d102a16a6106ef2a484314a0 On require, shim.js reconstructs hostnames via string concatenation to hide destinations oob-worker.cf.workers.dev, with a DNS TXT-record base64...
Malicious code in damir-cbr-dawdntrnssbf (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b201b86e8198a519343eebfaa548af8848dcad42b507826b052f5c97fbcfa90f On require of the package, polyfill.js downloads a platform-specific binary from attacker-controlled Cloudflare Workers hosts...
CVE-2026-66452 WordPress Legal Text Connector of the IT-Recht Kanzlei plugin <= 1.0.13 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei = 1.0.13 versions...
CVE-2026-66452
CVE-2026-66452 affects the WordPress plugin “Legal Text Connector” by IT-Recht Kanzlei, versions
Security Bulletin: Cyber Fraud includes components with multiple known vulnerabilities
Summary Cyber Fraud includes components with known vulnerabilities. These have been addressed in the update. Vulnerability Details CVEID:CVE-2026-59887 DESCRIPTION: linkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test and...
WordPress Huge IT Login plugin <= 1.0.4 - Unauthenticated Account Takeover vulnerability
Unauthenticated Account Takeover vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Login Social versions = 1.0.4...
MAL-2026-13389 Malicious code in @voxepay/checkout (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ce33339fdc1c4c994f6062588e4f4278ee9074ddb04759504100e89084f4a96 No suspicious behaviors were identified in this package version. There are no install-time lifecycle scripts performing remote fetches, no hardcoded...
CVE-2026-66452: Missing Authorization
Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei = 1.0.13 versions...
PT-2026-68575
Name of the Vulnerable Software and Affected Versions IT-Recht Kanzlei Legal Text Connector versions prior to 1.0.14 Description The Legal Text Connector contains a broken access control flaw that allows unauthenticated users to gain unauthorized access to restricted resources. Recommendations...
Malicious Package
Overview tinkoff-fb-app-frame-page-height-dippy is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...
DoS (Denial of Service) linkify-it Dependency in Confluence Data Center
This High severity DoS Denial of Service vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.2, 10.1.2, and 10.2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 8.7 and a CVSS Vector of...
DoS (Denial of Service) linkify-it Dependency in Confluence Data Center
This High severity DoS Denial of Service vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.1.2, and 10.2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...
Malicious code in dolyame-boxy-atom-bnpl-image-card (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 484dee0934d765de93fad820114619db6ba613ac0eae09b9b402949f116e796f The package's main entry loads setup.js, which on require fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are...
WordPress Legal Text Connector of the IT-Recht Kanzlei plugin <= 1.0.13 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by hhhai in WordPress Plugin Legal Text Connector of the IT-Recht Kanzlei versions = 1.0.13...
MAL-2026-12263 Malicious code in tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc7dae6b0c575dcb758eec30a647592471c39ded904ff4ed379cadd93b4f6cf4 index.js requires./polyfill on load, which selects a platform-specific endpoint, fetches an opaque binary from runtime-assembled Cloudflare Workers...
CLSA-2026-1784856031 TuxCare security update for linkify-it (2 CVEs)
TuxCare rebuilt linkify-it to address 2 CVEs. Fixed in 4.0.1-tuxcare.1...
CLSA-2026-1784682996 TuxCare security update for linkify-it (2 CVEs)
TuxCare rebuilt linkify-it to address 2 CVEs. Fixed in 1.2.4-tuxcare.1...
CLSA-2026-1774225205 TuxCare security update for markdown-it (1 CVE)
TuxCare rebuilt markdown-it to address 1 CVE. Fixed in 13.0.2-tuxcare.1...