MAL-2026-525 Malicious code in sandbox-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de188418d12a5397810d78eeeb5b8e939a4fc430f8c2aa3113e7fa3a5360e2c8 The package sandbox-hooks was found to contain malicious code. Source: ghsa-malware 7d12de65eeb03f7f648a293f5f7217cce1215878610d2bf4f973cd510733eedb...

Malicious code in magento-coding-standard-eslint-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 181566f148b6cac8ad613b2942849254b7a6968bbe5e16a9d009aaa8e4184b25 The package magento-coding-standard-eslint-plugin was found to contain malicious code. Source: ghsa-malware...

Malicious code in hammer-jquery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0e80d8bb4c65368f8c47250020a44866a9d32f6182fb7b5f2aed113723d35d8 The package hammer-jquery was found to contain malicious code. Source: ghsa-malware 72eb1b0f96efc21e3317dc341fbe50547a0d31332d3fc8470fc5a6c1c85053be...

Malicious code in @afg-ikea/ikea-modals (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec5202678b3acce22244ccd41e821e68167ca297f94450cb3b5debeac9ec2c50 The package @afg-ikea/ikea-modals was found to contain malicious code. Source: ghsa-malware...

MAL-2026-519 Malicious code in @afg-ikea/ikea-modals (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec5202678b3acce22244ccd41e821e68167ca297f94450cb3b5debeac9ec2c50 The package @afg-ikea/ikea-modals was found to contain malicious code. Source: ghsa-malware...

MAL-2026-518 Malicious code in @afg-ikea/ikea-kiosk-related-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f627f92f7e8b9ae99be35718e43eb73ed63a8818cea75a131f4bf85738cab2c3 The package @afg-ikea/ikea-kiosk-related-components was found to contain malicious code. Source: ghsa-malware...

Malicious code in @afg-ikea/ikea-kiosk-related-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f627f92f7e8b9ae99be35718e43eb73ed63a8818cea75a131f4bf85738cab2c3 The package @afg-ikea/ikea-kiosk-related-components was found to contain malicious code. Source: ghsa-malware...

MAL-2026-517 Malicious code in @afg-ikea/ikea-family-registration-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1ac39afe31e807b61c9297e45f81042917f9e889e1ceb953fcaeba093c75576 The package @afg-ikea/ikea-family-registration-module was found to contain malicious code. Source: ghsa-malware...

SUSE CVE-2026-22771

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communica...

Delinea Secret Server On-Prem Security Vulnerability

Delinea Secret Server On-Prem is a privileged access management platform provided by the American company Delinea. Versions 11.8.1, 11.9.6, and 11.9.25 of Delinea Secret Server On-Prem contain security vulnerabilities. These vulnerabilities stem from improper authentication procedures, which may...

JavaScript Sensitive Information Disclosure Scanner

This tool performs automated crawling and heuristic scanning of JavaScript files linked within a target website. It identifies exposed secrets such as API keys, access tokens, cloud credentials, private keys, and database passwords that may be unintentionally published within frontend resources. ...

BIT-NODE-MIN-2025-55131

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover...

Incorrect X25519 clamping check rejects all secrets on import

The latest releases of the libcrux-psq crate contains the following bug-fix: 1301: Fix broken clamping check for imported X25519 secret keys...

CVE-2025-59102 Secrets Stored in Plaintext in Database in dormakaba access manager

The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database contains the whole configuration. This includes encrypted MIFARE keys, card data, user PINs and much more. The PINs are even stored unencrypted. Combined with...

CVE-2025-59095

CVE-2025-59095 affects dormakaba Kaba exos 9300 software. Public descriptions in multiple sources indicate that DLLs/binaries (notably Kaba.EXOS.common.dll) use a hard-coded, static cryptoKey with a simple XOR-based encrypt/decrypt routine to process user PINs before storing them in MSSQL. The ro...

CVE-2025-59095

The program libraries DLL and binaries used by exos 9300 contain multiple hard-coded secrets. One notable example is the function "EncryptAndDecrypt" in the library Kaba.EXOS.common.dll. This algorithm uses a simple XOR encryption technique combined with a cryptographic key cryptoKey to transform...

MAL-2026-512 Malicious code in overstock-component-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 387cbf7de757b1668d6c0f2c9f81f9beab4f35af6f362c2ee434509070af2e34 The package overstock-component-library was found to contain malicious code. Source: ghsa-malware...

Malicious code in overstock-component-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 387cbf7de757b1668d6c0f2c9f81f9beab4f35af6f362c2ee434509070af2e34 The package overstock-component-library was found to contain malicious code. Source: ghsa-malware...

MAL-2026-516 Malicious code in overstock-login-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 359cd99825c90001defddafc25d74d784b4e71a75a8adf92e90f2371dbf8a124 The package overstock-login-layer was found to contain malicious code. Source: ghsa-malware...

Malicious code in overstock-login-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 359cd99825c90001defddafc25d74d784b4e71a75a8adf92e90f2371dbf8a124 The package overstock-login-layer was found to contain malicious code. Source: ghsa-malware...