MAL-2026-18137 Malicious code in codecraze (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1811daf51a786c7fc7dfea9a979a5f53626825eca9d18b61220b6366617ecb33 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18147 Malicious code in solivoxtts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c512c506dd4828aef5dd993cce389de4500f6c2e3c1906f1440e71cf455c64e7 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in solivoxtts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c512c506dd4828aef5dd993cce389de4500f6c2e3c1906f1440e71cf455c64e7 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in tessivatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2d8e0f874c40346588bbb4f025cb9be6ac29dc2fc6b95de5b662ac2126a628a1 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in vellutts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a36ed984afc7ca3475fe4852ef18158dc5569b049a35f4a23fd9260dc342c795 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in grommatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 19b2f82a5bea773c2f47efa91e029f047a508d4c8d117eb102728056d0ac5bc3 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in zennittts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8a405494d56b12c5eabd44355e1b97dd09406522e9e2211193e6df2123592dda This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in aurenatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ecc8915a04d9fbab4ecc0437f5eb05357d2e63bc3d30f629d67c7b3eb2c98eeb This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

MAL-2026-18143 Malicious code in phonoviatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0ad248ff66471a497d4c3a6d16384648636101a927c384cd4870adf920eced97 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in phonoviatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0ad248ff66471a497d4c3a6d16384648636101a927c384cd4870adf920eced97 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in voxilaratts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 39377b8b4c1d6d3243cb82f3e86bdc38869bf56e3800bf02ae817a1555ddb11b This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in brummatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 605ea05e6c6344e7ddfb713297d7689ee050288b74ecbf0821039603dc3cdd45 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in melcuratts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8bd7e6eda0ded5ef0e82eac489faca560422a8b8e46fd9c8d9b8215d9e89e6ba This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in quillonatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6297f0fae1c96dd5abefc4dd7f67a51ee7a737d1bb437fcffaed067d44d637a4 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in shellgrip (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9e23472f83d676f848fc137b96283dd8819ee900b3f371400aa8263bb4f70339 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in batchspar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 76a342534dec5ecb047459f9123ae99c1b91ef8e84305854529a260b8d2a3acd This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

Malicious code in crenelatts (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4ccd88fc743d2fd427510543af873fff8780bb4ec4916a565afb729315f28068 This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage...

html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword

A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting XSS due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary scrip...

CVE-2026-114130

The Nuxt web development framework for Vue.js is vulnerable to a cross-site scripting (XSS) issue prior to version 4.6.0 . When the pages feature is disabled, the no-pages router incorrectly classifies an attacker-controlled input as an internal route if it is prefixed with an ASCII C0 control ch...

Vite: Cross origin script execution through Vite custom middleware

Summary When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server. Impact Only apps that match the following conditions are affected: - the dev server passes an unchanged browser request URL to...