17 matches found
capacitor-flaw-cve-2026-103922
Capacitor 移动框架漏洞（CVE-2026-103922） 一个被追踪为 CVE-2026-103922 的高危安全漏洞已在 Capacitor 中被发现，Capacitor 是 Ionic 推出的流行跨平台移动应用框架。该漏洞暴露了原生桥接机制，可能允许应用内渲染的恶意 Web 内容在宿主 iOS 或 Android 设备上执行任意原生代码。\n\n我们最新的安全公告详细介绍了桥接利用的机制、受影响的特定 Capacitor 版本，以及移动开发者必须实施的关键更新，以保护其混合应用的安全。\n\n请在我们的官方安全门户上阅读完整技术分析。 在此阅读完整技术解析 由 Kiran...
CVE-2026-82090
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...
CVE-2026-82090
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...
CVE-2026-82090
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...
EUVD-2026-67403
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...
CVE-2026-82090
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...
CVE-2026-82090
Pocket for Android (versions through 8.33.0.0 ) is affected by a Cross-Site Scripting (XSS) vulnerability rated CVSS 4.0 9.2 (CRITICAL) . The root cause is that the "Save to Pocket" feature injects external HTML into the DOM, allowing injected JavaScript to alter the application state via native ...
PT-2026-82870
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...
CVE-2026-82090: Improper Neutralization of Input During Web Page Generation
Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...
Malicious code in node-native-bridge (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc9503b92533dc98c475b75c09a1c40fcec67ad7b56c488b9677c0ff0740c4d2 The package node-native-bridge was found to contain malicious code. Source: ghsa-malware...
Malicious Package
Overview node-native-bridge is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-965 Malicious code in node-native-bridge (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc9503b92533dc98c475b75c09a1c40fcec67ad7b56c488b9677c0ff0740c4d2 The package node-native-bridge was found to contain malicious code. Source: ghsa-malware...
Malicious code in ecinc-cloud-moaxmpp (npm)
Package exhibits multiple malicious behaviors: Office doc access/encryption, DB interaction, local storage clearing, arbitrary code execution, /dev/shm ref. The code includes a native bridge that allows it to execute arbitrary SQL queries on a mobile device’s database when used within a specific...
Malicious code in wdpr-ra-javascript-native-bridge (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2e2b40d8e2ee8d311cf5e007c4480255217d359bdde3c42115e42ad42f35dbb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in wdpr-ra-javascript-native-bridge
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...