MAL-2026-742 Malicious code in dcf-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ecd9b19358b9d41493159b26a9674d97911b844be08acab24e938855a796ada The package dcf-commons was found to contain malicious code. Source: ghsa-malware 53fcdc9ba42b2a38388a8f7892b9ba26435e40dd2c5ad4247358620829f70b58 An...

Malicious code in internationalized (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bb89ff076b952ec364a4b84d4b37a0f83632bea82a2a63b9153d6af9a6145ad The package internationalized was found to contain malicious code. Source: ghsa-malware...

RUSTSEC-2026-0072 Missing Check for All-Zero X25519 Shared Secret

Computing an X25519 shared secret with x25519dalek::StaticSecret::diffiehellman does not include the check that the key exchange was contributory, i.e. does not ensure on its own that the resulting shared secret is non-zero. Impact RFC 9180 mandates that implementations of HPKE must check for all...

Missing Check for All-Zero X25519 Shared Secret

Computing an X25519 shared secret with x25519dalek::StaticSecret::diffiehellman does not include the check that the key exchange was contributory, i.e. does not ensure on its own that the resulting shared secret is non-zero. Impact RFC 9180 mandates that implementations of HPKE must check for all...

Malicious code in docusaurus-plugin-launchdarkly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e875ce6b5b0d95c7100cdba68bed891c712b414716f07147e6a3f04f4f9b4789 The package docusaurus-plugin-launchdarkly was found to contain malicious code. Source: ghsa-malware...

MAL-2026-735 Malicious code in docusaurus-plugin-launchdarkly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e875ce6b5b0d95c7100cdba68bed891c712b414716f07147e6a3f04f4f9b4789 The package docusaurus-plugin-launchdarkly was found to contain malicious code. Source: ghsa-malware...

CVE-2025-15482

The Chapa Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 via 'chapaproceed' WooCommerce API endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including t...

CVE-2025-15482

The Chapa Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 via 'chapaproceed' WooCommerce API endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including t...

CVE-2025-15482 Chapa Payment Gateway Plugin for WooCommerce <= 1.0.3 - Unauthenticated Sensitive Information Exposure

The Chapa Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.3 via 'chapaproceed' WooCommerce API endpoint. This makes it possible for unauthenticated attackers to extract sensitive data including t...

Malicious code in z-shop-event-bus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db54dce43d20da63e308cbd0ae4785225d093b5bd8b5d7c202e0f17a19ba11c2 The package z-shop-event-bus was found to contain malicious code. Source: ghsa-malware 4e51cf3a7018daddc8f2ba956f6e030ec57f8bad1e45102d29243c9dd13d48...

MAL-2026-726 Malicious code in z-shop-event-bus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db54dce43d20da63e308cbd0ae4785225d093b5bd8b5d7c202e0f17a19ba11c2 The package z-shop-event-bus was found to contain malicious code. Source: ghsa-malware 4e51cf3a7018daddc8f2ba956f6e030ec57f8bad1e45102d29243c9dd13d48...

MAL-2026-724 Malicious code in https-emailjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8aff232c81a7253eeb9e10075207aebc5908976a9a1adf6009d750b444467db The package https-emailjs was found to contain malicious code. Source: ghsa-malware e6feff6e256b4c145082869f4ce5f64f2a2a15cab09caeef3e3d5735188aa0f6...

Malicious code in @fxinternal/netdiagnostics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e2484371522051117d2994af8795b9caef31467aaa40edfacfc8d80a45fd820 The package @fxinternal/netdiagnostics was found to contain malicious code. Source: ghsa-malware...

Malicious code in express-groups-routes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d54e03ffa96877bc24a447c0a77e5c096894fd82176e5705d62713eb5f20f10 The package express-groups-routes was found to contain malicious code. Source: ghsa-malware...

MAL-2026-712 Malicious code in ongose (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba1779f3d5601055650bab2b59f56ba51bc92366ccd49d815010ef67839f1257 The package ongose was found to contain malicious code. Source: ghsa-malware da279e18ef68f92cc1f02d94f9be7149d4664988f627ff7efbfcda617a237761 Any...

Malicious code in mongooose_updated (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f397bd93c8a607a5fb7cb6c4da24be0ed65157020f40d778f66f4bb8f0c6237b The package mongoooseupdated was found to contain malicious code. Source: ghsa-malware c02f092aac581da5247eba7163d5bcbb065ed41865e8eeb464ea1fedd8a4d6...

CVE-2025-69971

FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access...

GHSA-9H3P-52VH-959W ingress-nginx's `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/auth-method Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to t...

ingress-nginx's `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx

A security issue was discovered in ingress-nginx where the nginx.ingress.kubernetes.io/auth-method Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to t...

GHSA-JX8C-56MG-H6VP ingress-nginx's `rules.http.paths.path` Ingress field can be used to inject configuration into nginx

A security issue was discovered in ingress-nginx. Tthe rules.http.paths.path Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. Note that in...