MAL-2026-13769 Malicious code in svelte-vim-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0c572d78a3be9d0fc30b6124c044c329fec518da18bb9e1ca3c22d7f18195e3 No a static rule matches or traced behavior indicative of exfiltration, install-time remote code execution, silent relay, credential distribution,...

Malicious code in svelte-vim-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0c572d78a3be9d0fc30b6124c044c329fec518da18bb9e1ca3c22d7f18195e3 No a static rule matches or traced behavior indicative of exfiltration, install-time remote code execution, silent relay, credential distribution,...

MAL-2026-13740 Malicious code in kit-vim-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1b76be1956e2772f73d7712934ee4a296d4407df590f6ca4225db7310de916 The package advertises itself as a dependency-free calendar/streak math library but ships a Linux x8664 ELF at dist/internal/calc-math.dat. The main...

Malicious code in kit-vim-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1b76be1956e2772f73d7712934ee4a296d4407df590f6ca4225db7310de916 The package advertises itself as a dependency-free calendar/streak math library but ships a Linux x8664 ELF at dist/internal/calc-math.dat. The main...

Security Bulletin: Vulnerability in p11-kit affects IBM Netezza Appliance

Summary The p11-kit package is used by IBM Netezza Appliance . IBM Netezza Appliance has addressed the applicable CVE CVE-2026-2100 Vulnerability Details CVEID:CVE-2026-2100 DESCRIPTION: A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the CDeriveKey...

MAL-2026-13770 Malicious code in @telekom-ods/react-ui-kit (npm)

@telekom-ods/[email protected] ships an install hook that spawns a shell running a reconnaissance/exfiltration one-liner. The captured command reads /etc/passwd and /etc/hosts, runs id, and conditionally reads /etc/shadow if the process has read access, then sends the collected output as the...

Malicious code in svelte-kit-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b52621d72853042287f8152d66c3f465b510af17f7b16283d9ab64ee01dc13cb [email protected] was scanned across 8 files with no a static rule matches and no traced behaviors indicating exfiltration, install-time remote...

MAL-2026-13726 Malicious code in svelte-kit-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b52621d72853042287f8152d66c3f465b510af17f7b16283d9ab64ee01dc13cb [email protected] was scanned across 8 files with no a static rule matches and no traced behaviors indicating exfiltration, install-time remote...

Malicious code in godot-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector edb0e7385ab0574f7223206d79822362c142c664b0aed0ae5a00546b6bb38ef4 lang/gdscript.js appends a hostile IIFE after module.exports that runs when the module is require'd reachable via lang/loader.js and test.js. The...

New turnkey kit makes it easy for anyone to become a scammer

In 2026, online scams have unfortunately become part of the new normal. They can appear almost anywhere, from social media and messaging apps to search results, websites, and online communities, and they can target anyone. Sometimes, all it takes is a moment of curiosity and a convincing offer...

Security Bulletin:Multiple security vulnerabilities in IBM Process Automation Manager Open Edition Starter Kit for Banking

Summary In addition to many updates of operating system level packages, Multiple vulnerabilities were addressed in IBM Process Automation Manager Open Edition Starter Kit for Banking -9.4.2 Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fai...

CVE-2026-18473

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-18473

The CVE affects the WP Directory Kit WordPress plugin prior to 1.5.5. Root cause: the plugin does not properly sanitize/escape a parameter before using it in an SQL statement, enabling an unauthenticated SQL injection (via the field_search parameter). Impact is high (unauthenticated access; poten...

EUVD-2026-54880

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-18473

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-18473 WP Directory Kit < 1.5.5 - Unauthenticated SQL Injection via 'field_search' Parameter

The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

MAL-2026-13677 Malicious code in svelte-kit-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ea03ff1abc711e776243e207270c0f7d208521386cc87d94fbb8d64300beb9d No static or behavioral indicators of supply-chain attack were observed in this package version. No lifecycle scripts fetching or executing remote...

Malicious code in svelte-kit-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ea03ff1abc711e776243e207270c0f7d208521386cc87d94fbb8d64300beb9d No static or behavioral indicators of supply-chain attack were observed in this package version. No lifecycle scripts fetching or executing remote...

Malicious code in svelte-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2172e0671582a6e9c3359cd893cb96a7a09706ae0670208ddfbc82636a828fed [email protected] was scanned across 8 files with no a static rule matches and no traced behaviors indicating credential access, exfiltration,...

MAL-2026-13679 Malicious code in svelte-streak-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2172e0671582a6e9c3359cd893cb96a7a09706ae0670208ddfbc82636a828fed [email protected] was scanned across 8 files with no a static rule matches and no traced behaviors indicating credential access, exfiltration,...