Malicious code in simple-date-formatter-new-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd79db99adb8878673dd85db5a29661432808fa8fcc5e3d750b907418df8ae5f npm package [email protected] declares a postinstall lifecycle script in package.json that runs automatically on npm install. The...

MAL-2026-17229 Malicious code in simple-date-formatter-new-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd79db99adb8878673dd85db5a29661432808fa8fcc5e3d750b907418df8ae5f npm package [email protected] declares a postinstall lifecycle script in package.json that runs automatically on npm install. The...

MAL-2026-17223 Malicious code in chalk-figlet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b package.json declares a postinstall script node example.js that requires index.js at install time. index.js contains a function named syncTelemetry...

Malicious code in chalk-figlet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66dfb43d5f4ae643e32497447293c12170a21f258a7e7d3d07e8f90f2119e13b package.json declares a postinstall script node example.js that requires index.js at install time. index.js contains a function named syncTelemetry...

MAL-2026-17227 Malicious code in nebula-llm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b33da6aef41209f654f8f76cc56074a7b827599f42f941e3917326da1f4d2566 The npm package [email protected] ships a preinstall lifecycle script preinstall.cjs that embeds a 257KB Windows PE binary as a base64+zlib-compressed...

Malicious code in nebula-llm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b33da6aef41209f654f8f76cc56074a7b827599f42f941e3917326da1f4d2566 The npm package [email protected] ships a preinstall lifecycle script preinstall.cjs that embeds a 257KB Windows PE binary as a base64+zlib-compressed...

MAL-2026-17225 Malicious code in fabric-render-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2715ef0b07fbf0ca24fb8dadec44f2fcfdc273421a49ad2201bf8e40d3e2c01 package.json declares postinstall="node index.js", so npm install fabric-render-bridge automatically executes index.js. index.js reads Minecraft...

MAL-2026-17215 Malicious code in eslint-plugin-skywagon-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c5d134d2e79b24ed65d2998520db05b5cc86b251ae579a6d8cec6d8fe02340f [email protected] ships an index.js that is executed via a preinstall lifecycle script on npm install. The script collects...

Malicious code in eslint-plugin-skywagon-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c5d134d2e79b24ed65d2998520db05b5cc86b251ae579a6d8cec6d8fe02340f [email protected] ships an index.js that is executed via a preinstall lifecycle script on npm install. The script collects...

CVE-2026-82387

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with media-upload rights to store active content on Roller's origin, because the media upload feature trusts the upload-supplied content type and serves the stored file back wit...

CVE-2026-82381

Apache Roller version 6.1.5 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw due to improper neutralization of input during web page generation. An attacker with authoring rights on a weblog can store crafted content that is injected into the authoring UI's JavaScript string literals and...

CVE-2026-84645

A flaw was found in Jenkins. This vulnerability allows a remote attacker to achieve remote code execution. By manipulating user-submitted configuration files, an attacker can exploit a deserialization weakness where specially crafted objects can process HTTP requests. This grants unauthorized...

PT-2026-99929

Name of the Vulnerable Software and Affected Versions Network UPS Tools affected versions not specified Description A GitHub Actions script used to prepare tarballs and update GitHub Checks statuses and PR comments was mis-structured. The script mixed code running with higher privileges,...

Important: dovecot

Issue Overview: An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust...

CVE-2026-100741 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...

EUVD-2026-87885

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion...

CVE-2026-100741: Improper Neutralization of Directives in Dynamically Evaluated Code

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...

CVE-2026-100646 SiYuan before v3.8.4 Authentication Bypass via Missing Origin Header

SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go fail open when the HTTP Origin header is absent, on the incorrect assumptio...

CVE-2026-92411

The WP Delicious WordPress plugin (versions prior to 1.10.8 ) is vulnerable to Stored XSS . The root cause is a failure to validate or escape the HTML tag name extracted from user-supplied recipe block data before it is rendered on the front end. This allows authenticated users with the Contribut...

CVE-2026-100521 Cotonti through 1.0.0 Reflected XSS via search highlight parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...