EUVD-2026-53335

@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync. A user-controlled project-name argument is inserted into the shell command without proper...

CVE-2026-71250

Firefly III's webhook URL validator IsValidWebhookUrl.php filters most private/reserved IPv4 ranges but contains an explicit early-return that allows any resolved address in 127.0.0.0/8, permitting an authenticated user with webhooks enabled, which is off by default to configure a webhook targeti...

CVE-2026-71245

Rejected reason: Red Hat CNA-LR concluded that this CVE is not valid...

CVE-2026-71246 Pixelfed - Authenticated SSRF via Remote URL Search

Pixelfed's SearchController behind the auth middleware accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl only blocks the literal hosts 127.0.0.1, localhost, and ::1 and requires https, without checking the resolved IP...

EUVD-2026-53318

Mautic's getLeadIdsByFieldValueAction LeadBundle/Controller/AjaxController.php reads a field parameter from the request, sanitizes it only with InputHelper::clean which HTML-entity-encodes quotes and angle brackets but does not restrict other characters, and passes it into...

MAL-2026-12294 Malicious code in twork-data-services-ng14-aggregator-api-v2-data-view-user-b2b-create-deal-mf-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bd345f2352931f35e602b49b89ce3977c58dc6ad3e70e3164a0144676ee7c4f On require, index.js loads adapter.js, which downloads a platform-specific binary from Cloudflare Workers hosts under oob-worker.cf10x-.workers.dev...

MAL-2026-12290 Malicious code in twork-data-services-customer-api-v2-customer-vip-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd6182daf75450f1e553f81c3979a275c481690e27d04712285b85a25ebadc3b On require of this package, index.js loads platform.js which selects a platform-specific payload linuxx64/linuxarm64/darwin/win32, downloads an opaqu...

MAL-2026-12211 Malicious code in statist-browser-typed-client-mb.product.analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 846c740775556f5a2d302684c1bc3f5d39aea88a5208b98a2730c3ffff1308e7 On require of the package, index.js loads bridge.js which detects the host platform, fetches a native binary from a rotating list of hardcoded...

Malicious code in a.poltoradnev-package-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebe5bbc564bb1c441ce12acaf4d177fabcd3fe5963f3c870119ee1519abab675 On require of the package, index.js loads bridge.js which selects a platform-specific output path, fetches an opaque binary over HTTPS from Cloudflar...

MAL-2026-12173 Malicious code in bnpl-blocks-desktop-bnpl-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4909f4a2b9f9355cd2cbde2b75f8a5d7d3f4ec6b79ed828fdb9cc18b23107e0 On require of the package, index.js loads./setup, which selects a platform-specific URL, fetches an opaque binary from string-concatenated Cloudflare...

MAL-2026-12286 Malicious code in trapp-check-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fea7c6987689190a5c45008fc1bfbf14ae177c63630b38ced1190e0c5c3d7661 On require of the package, index.js loads bridge.js which selects a platform-specific payload path, fetches bytes over HTTPS from...

Malicious code in tramvai-module-feature-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8841208443b6595c8389bfac3e1cdb59a65ad0bc05a8dd3e01ca5c661287e56 On require of the package, index.js loads setup.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12285 Malicious code in tramvai-module-feature-toggle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8841208443b6595c8389bfac3e1cdb59a65ad0bc05a8dd3e01ca5c661287e56 On require of the package, index.js loads setup.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts...

MAL-2026-12178 Malicious code in fb-cards-form-no-resident-information (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f5f533e1e08aafbda3bd64998ad984e90345592ecc1a9fd14f6d449413e6c87 On require of the package, index.js loads adapter.js which reconstructs Cloudflare Workers hostnames from split string fragments e.g. 'oob-worker' +...

Malicious code in accounts-card-design-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5bdaa2c933125ad6b8c88277ca7b778654f4a73bf7d6b1c9e945a4e9a2a80eed On require of the package's main, index.js loads platform.js, which fetches a platform-specific native binary from Cloudflare Workers hosts assembled...

Malicious code in tinkoff-boxy-gitlab-labels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 995279b7bea8c6d826ee620cb5a31dc38662a1ba4d4b07bda9fc941908daa1e3 On require of the package, index.js loads runtime.js which selects a platform-specific payload path, fetches an opaque native binary from...

MAL-2026-12279 Malicious code in tinkoff-statist-web-typed-client-test.golden.retriever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 352e7120bec31271d79af9befe17a46024f5785ffca010335fa13eb40c946e3a On require of the package, index.js loads init.js which reconstructs attacker-controlled hostnames via array-join string obfuscation four...

Malicious code in tinkoff-statist-web-typed-client-test.golden.retriever (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 352e7120bec31271d79af9befe17a46024f5785ffca010335fa13eb40c946e3a On require of the package, index.js loads init.js which reconstructs attacker-controlled hostnames via array-join string obfuscation four...

MAL-2026-12267 Malicious code in tinkoff-statist-browser-typed-client-mb.product.restrictions.arrestments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86cb27375f9846c6aeba581e7e7ec6112eefd54f8d743638a1e803bde3d46616 On require of the package's main index.js, loader.js selects a platform-specific endpoint and fetches an opaque native binary over HTTPS from a...

MAL-2026-12230 Malicious code in tinkoff-boxy-desktop-two-panel-right-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a347918d0341f95fdb00b2e148c6709be7d7126be5f629ce9515d2349624246 On require of this package, index.js loads vendor.js which detects the host OS/arch, assembles destination hostnames from split string fragments...