Malicious code in lib-frontsga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53a65c44cfdcbc89df47508f3f87fcab836f1fa2f4adf2298ecfb47cd6088038 Package name 'lib-frontsga' published to the public npm registry at version 9.999.999 targets an internal package name via dependency-confusion...

Malicious code in @activepieces/piece-google-bigquery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acc3321f587f5a8efea8256aeb935a905df2da5f5a901cd8f7355a75e3832da3 The package presents itself as an Activepieces connector for Google BigQuery but src/index.js combines require"childprocess", an OS reconnaissance...

Malicious code in @activepieces/piece-google-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06d347d6252c2a1bb21b4318c0a319be36d60a95b4146d91108cee13d52c5759 The published tarball for @activepieces/piece-google-forms 0.5.7 contains src/index.js which imports childprocess, invokes ping-style OS command...

CVE-2026-14829

The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information, allowing unauthenticated...

CVE-2026-5336: Exposure of Sensitive Information to an Unauthorized Actor

The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...

PT-2026-68753

Name of the Vulnerable Software and Affected Versions DataPress Dataverse Integration WordPress plugin versions prior to 2.91 Description Insufficient access restrictions in the template rendering feature allow users with Contributor roles to disclose sensitive information. This issue occurs...

NPM: Nuxt: Unauthorized Component Instantiation via Server Island Props

NPM: Nuxt: Unauthorized Component Instantiation via Server Island Props vulnerability discovered by ? in WordPress Npm nuxt versions = 3.1.0, 3.21.10...

opentaint analyzer/latest

The open source taint analysis engine for the AI era Formal taint analysis for application security — finds what AST-pattern matchers miss, lets LLM agents enact rules from vulnerabilities, scales where neither can alone. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dan...

CVE-2026-70444

A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 security update

Updated images are now available for Red Hat Ansible Automation Platform 2.1, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub. Red Hat Ansible Automation Platform 2.1 delivers an Ansible-first Red Hat Developer...

CVE-2026-9193

An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database...

CVE-2026-70601 Electron: Context isolation bypass via Function.prototype.bind hijack

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

CVE-2026-70601 Electron: Context isolation bypass via Function.prototype.bind hijack

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

CVE-2026-9193

The CVE concerns Progress MarkLogic Server’s Hadoop integration. Affected: MarkLogic Server versions prior to 11.3.6 and 12.0.3. Root cause: improper privilege management allows an authenticated user with a low-privileged Hadoop role to escalate privileges and perform privileged operations agains...

CVE-2026-9193

An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database...

CVE-2026-9193 Privilege escalation in Progress MarkLogic Server Hadoop integration

An improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged operations against the Security database...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update

Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub. Red Hat Ansible Automation Platform 2.2 delivers an Ansible-first Red Hat Developer...

vuln-agent

vuln-agent AI-powered vulnerability scanner + exploit-researc...

MAL-2026-12748 Malicious code in devplatform-s3-resources (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85d9e5338b835856fe3c5e45555c1a6bfbb6b7f412a83bbfaa0841813eeeeeb1 On load, index.js unconditionally requires./compat.js, which selects a platform-specific binary URL from string-split-obfuscated Cloudflare Workers...

Malicious code in widget-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc77fe941595018023e8382eac28ffdf8d1b000217a0e4d01e56e7bb48ac2d8 [email protected] is a dependency-confusion beacon. package.json declares scripts.preinstall = 'node callback.js', which auto-runs on npm install...