EUVD-2026-116585

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections,...

CVE-2026-121727

Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections,...

Malicious code in guras-visa-kore (npm)

Source: amazon-inspector 2905d7946caa812ca9ebad256eb59fbb1c13926e123185b3962fa9b6c798949e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in nokire-kore18 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a46ce997b666cb0e9b6874e83f5b34db28780a2cd91620885107a1b45162c6ce This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-162705 Malicious code in nokire-kore19 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a501bc2cd166aa54bff3e6e7509d98e498502b3832b3d26d0714d987adbb532 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-155481 Malicious code in guras-visa-kore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2905d7946caa812ca9ebad256eb59fbb1c13926e123185b3962fa9b6c798949e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in guras-visa-kore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2905d7946caa812ca9ebad256eb59fbb1c13926e123185b3962fa9b6c798949e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2022-7070 Malicious code in web-kore-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e3d285159349aa1579c27570b9fb1498a6a64f8798cf889e368d96a3d3a0931 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in web-kore-sdk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in web-kore-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e3d285159349aa1579c27570b9fb1498a6a64f8798cf889e368d96a3d3a0931 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview web-kore-sdk is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Kore, Official Remote for Kodi - External URLs, Suspicious files, Unsafe deleting vulnerabilities

HackApp vulnerability scanner discovered that application Kore, Official Remote for Kodi published at the 'play' market has multiple vulnerabilities...