42682 matches found
MAL-2026-6920 Malicious code in crypto-base58 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7da752b2532b67e824f8904ffce7618b074a6a58746099b36b4ee547d936c8d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-6924 Malicious code in solana-address-codec (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e1008cff7bb82464ce9ade3ae5c353e929b7367800b404a038baa8a026c69ae The package name resembles utilities in the Solana ecosystem e.g., @solana/addresses and address codec helpers, which is a common target for typosqua...
Open WebUI Vulnerable to Cross-Site Scripting (XSS) via Chat File Upload
A Stored Cross-Site Scripting XSS vulnerability exists in the chat file upload functionality of open-webui/open-webui version 0.3.8. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or shared chat, executes JavaScript in the victim's browser. Th...
PYSEC-2026-1394 FastChat open redirect vulnerability
An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft...
PYSEC-2026-1339 Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js
Note On Thursday, June 27, 2024, Cloudflare and Namecheap intervened at a domain level to ensure polyfill.io and its subdomains could not resolve to the compromised service, rendering this vulnerability unexploitable. The following sections describe this vulnerability prior to the domain level...
Malicious code in mcp-server-pg (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22d68bdfced357622e33e4608bd35ded4d8988ea6dc7da073b3a83075978815d On npm install, scripts/postinstall.js unconditionally reads a range of installer-owned identity and configuration files and POSTs a JSON payload to ...
MAL-2026-7446 Malicious code in zircuit-vault (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7429 Malicious code in treactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7425 Malicious code in style-to-objact (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7424 Malicious code in strapi-plugin-pocvk (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7402 Malicious code in rn-bitu-user (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7390 Malicious code in revactjs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7376 Malicious code in reauctjs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7359 Malicious code in reabctjs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7336 Malicious code in oztxrk-mfa (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7288 Malicious code in fnnote-combined (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7273 Malicious code in elf-stats-shimmering-cushion-351 (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-7274 Malicious code in elf-stats-silvered-sled-455 (npm)
--- -= Per source details. Do not edit below this line.=-...