Malicious code in svelte-streak-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 211b40d9426fc23200004fb66f846a5e31dd27dafb924bd99957954f6f4dd1f6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in svelte-insights-streak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13837ce89a955f11d9e25b59ca9b59b96ffef7d05338f95b42d1fcd062c7b543 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

BIT-KEYCLOAK-2026-17048 Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only...

Malicious code in mkb-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27bc086d2159cad3d4eb02427ea2daa5f66ad57c39cbbaad5a8bb367071f4fb7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14490 Malicious code in mkb-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27bc086d2159cad3d4eb02427ea2daa5f66ad57c39cbbaad5a8bb367071f4fb7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14469 Malicious code in tungtungisgoated (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d649ce9c915a5834ac0743a8f47377d31c293de34fbe40581c2f7ce3ca56c8da The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in ilovedesmos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0efb46da64ab0f3eaee41abecec08214a4af0f228c701fd39ad711c0ae124927 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in pleasedoyourhomework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c97c52ac22393718c1c8fd5478b19b5b352b1f8c01de5f2aa39e54c3305eaf1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in sonsonsahur (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d56e98f205b0c56ba4ee1948a10f1aaaccbbad4556e01569bfab9945ec8ad7e2 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in classroomlesson (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cee9290a110b32c6fab4129e634205ed0b86080ccf328dfe5e17635bc85b7926 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in superdupertest111 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84dafc169a0c96b769349ac7685ff37d6ad663db50df14862a784173cde38dbe The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in schoollesson (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c019b72671bb34207fbc587803e391f42f2fd3148c3ac941d9a8cfc8468a7e8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14457 Malicious code in desmosschoolwork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9575a8846e102604d72f61d91f37c559e58d0fca4c117008257d096afc2a2acb The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in desmosmathwork (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eccdafeec1f447c84fcca9f7f17e41c8e940b8bd65c9caf72b1bddbb2befdea4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Insufficiently Protected Credentials

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the Twig sandbox configuration, which contains an incomplete default denylist. An attacker can access...

Duplicate Advisory: Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3jhr-mxmx-38cx. This link is maintained to preserve external references. Original Description Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and...

CVE-2026-76846

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get or config.toArray in Twig templates to retrieve sensitive values like...

CVE-2026-76839 Grav before 2.0.16 Information Disclosure via offsetGet

Grav before 2.0.16 allows sandboxed Twig templates to access sensitive User fields through allow-listed offsetGet and offsetexists methods that lack field filtering. Attackers with page-edit permissions can call offsetGet on User objects to extract hashed passwords and 2FA secrets, enabling offli...

CVE-2026-76846 Grav before 2.0.16 Information Disclosure via Twig Sandbox

Grav before 2.0.16 contains an incomplete default denylist in the Twig sandbox configuration that fails to block access to system configuration secrets. Attackers with page-edit permission can use config.get or config.toArray in Twig templates to retrieve sensitive values like...

CVE-2026-76846

Grav before 2.0.16 contains an incomplete default denylist in its Twig sandbox configuration. Attackers with page-edit permission can leverage config.get() or config.toArray() within Twig templates to exfiltrate sensitive system configuration secrets (e.g., system.cache.redis.password) when confi...