MAL-2026-12302 Malicious code in twork-data-services-sme-operations-authorizations (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d73622aa5b1b1b3f39f914022e80a8429b948186033c2e98d5f5610e93129612 On require of the package, index.js loads compat.js which fetches a platform-specific binary from hostnames assembled by array-join to hide them from...

Malicious code in twork-data-services-sme-operations-authorizations (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d73622aa5b1b1b3f39f914022e80a8429b948186033c2e98d5f5610e93129612 On require of the package, index.js loads compat.js which fetches a platform-specific binary from hostnames assembled by array-join to hide them from...

Malicious code in twork-data-services-aggregator-company-sme-main-timeline-loader-with-customers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 401d167bfbb3ec350a033f908aef6678495563e92c6b090d0eaab85bd1c2b7ba On require, index.js loads bridge.js which assembles obfuscated Cloudflare Workers hostnames from split string literals...

MAL-2026-12287 Malicious code in twork-data-services-aggregator-company-sme-main-timeline-loader-with-customers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 401d167bfbb3ec350a033f908aef6678495563e92c6b090d0eaab85bd1c2b7ba On require, index.js loads bridge.js which assembles obfuscated Cloudflare Workers hostnames from split string literals...

MAL-2026-12249 Malicious code in tinkoff-pfp-block-mobile-panels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba61172e292eb3f23c0077e187700932f461fc726674f5497030751138da2d3 On require of the package, helpers.js selects a platform-specific binary path, downloads bytes from one of four hardcoded Cloudflare Workers hosts...

MAL-2026-12186 Malicious code in pfp-forms-insurance-health (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dd718d214c6718fcbfa156788040734ad3dee63b06a5b72737ec099f64e0b96 On require'pfp-forms-insurance-health', index.js loads compat.js which immediately invokes a dropper routine. It selects a per-OS asset path, downloa...

Malicious code in pfp-forms-insurance-health (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dd718d214c6718fcbfa156788040734ad3dee63b06a5b72737ec099f64e0b96 On require'pfp-forms-insurance-health', index.js loads compat.js which immediately invokes a dropper routine. It selects a per-OS asset path, downloa...

CVE-2026-55998 Cluster Existence Oracle via Unauthenticated Import Endpoint

The endpoint /v3/import/tokenclusterId.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/privateregistry.go causes the request to return HTTP 502...

CVE-2026-55998

The CVE describes an unauthenticated import endpoint vulnerability: /v3/import/{token}_{clusterId}.yaml returns 502 for valid cluster IDs that reference clusters with private registry secrets due to a null pointer dereference in pkg/systemtemplate/private_registry.go ; non-existent cluster IDs re...

CVE-2026-55998 Cluster Existence Oracle via Unauthenticated Import Endpoint

The endpoint /v3/import/tokenclusterId.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/privateregistry.go causes the request to return HTTP 502...

CVE-2026-55998 Cluster Existence Oracle via Unauthenticated Import Endpoint

The endpoint /v3/import/tokenclusterId.yaml retrieves the cluster object before validating the token. When a valid cluster ID references a cluster that has private registry secrets configured, a nil pointer dereference in pkg/systemtemplate/privateregistry.go causes the request to return HTTP 502...

CVE-2026-17515

The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin & MLS Plugin for Real Esta...

Malicious code in streak-math-calc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f98537ccfd6214a3970375d9c210e83853153b35b19193b4b1850fe6450ed4f The package's main entry dist/index.mjs runs a top-level IIFE that chmod +x's a bundled ELF at dist/math-calc.bin and spawns it detached with piped...

CVE-2026-17515 MLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item

The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin & MLS Plugin for Real Esta...

EUVD-2026-53122

The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin & MLS Plugin for Real Esta...

CVE-2026-17515 MLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item

The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin & MLS Plugin for Real Esta...

CVE-2026-17515

The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin, in versions prior to 7.0.4 , is vulnerable to sensitive information disclosure. The root cause is a lack of authorisation and CSRF checks in one of its AJAX actions (specifically mlsimport_logger_per_item). This fla...

Malicious code in nxify-unic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2645ab342655ef98b8905299be8fc515978b43f6cf36ae564c9da827227dd391 On require'nxify-unic', index.js loads shim.js which detects OS/architecture, assembles destination hostnames at runtime by string-splitting and...

CVE-2026-18856

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery...

CVE-2026-18856 Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component Data Import Module. This manipulation of the argument filename causes server-side request forgery...