Malicious code in bnpl-blocks-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3b74429ec0cf706ca11dded285a5b89933db6cbbf2b38905c0b0549be62a8f1 On require'bnpl-blocks-analytics', index.js loads compat.js whose top-level start function downloads an OS-specific binary from Cloudflare Workers...

Malicious code in bnpl-blocks-desktop-bnpl-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6823826cd3999be6c3dac95d5731bbce9bee98ae0b7df019a3b85c97fd5d1bad The package is advertised as a UI footer component but side-loads bridge.js on require. bridge.js selects a platform-specific asset linux/darwin/win3...

MAL-2026-12687 Malicious code in delivery-ci-upgrade-from (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b1b760480eca3b3ad596491193f7aa55ed0a3e982d6978c071e04e793ff8b0 index.js unconditionally requires bridge.js, which runs a bootstrap routine on module load. The bootstrap selects a platform-specific path linuxx64,...

MAL-2026-12380 Malicious code in fb-forms-form-boilerplate-contacts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23bb3ca46733a388c550c5a1f6514c78b026447f355fcc669d1dfa0d58e8963a Package advertises itself as a form-boilerplate library but its top-level index.js unconditionally requires init.js, which on load downloads a...

Malicious code in eventea-diag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9941ff32c3b2d52ea7b7cccd4af391bfe359cf3766c4f22c484d1a51e178ab6c On require of the package, index.js loads shim.js which downloads a platform-specific binary from hardcoded Cloudflare Workers subdomains...

Malicious code in bpm-foundation-feature-flags (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4736a188169920cb89859c87cc5d53ed9a51db4f368f15546f2b999a6ec12045 On require of bpm-foundation-feature-flags, index.js loads init.js which downloads a platform-specific native binary from obfuscated Cloudflare Worke...

Malicious code in finance-business-company-id-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d324092012d8b7c4dda17720255575963c9e35fcd86e254541cdf7abb5edffcf On require of this package, index.js loads compat.js which reconstructs destination hostnames from string-split arrays e.g...

MAL-2026-12365 Malicious code in dolyame-boxy-independent-bnpl-info-images (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbef858bd27bf2cda5b64bb9171d90ffa7b7d95337277030c75f9fd4ea32c6f2 On require of the package, index.js loads adapter.js which selects a platform-specific payload path, downloads a binary from runtime-assembled...

Malicious code in pfp-block-mobile-steps (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4b4495333f6f37664594f2e6533842a4d3a317bb98bbc3a467797bb8ec851d7 On require of the package, index.js unconditionally loads shim.js, which selects a payload path based on process.platform/arch linuxx64, linuxarm64,...

MAL-2026-12229 Malicious code in tinkoff-boxy-desktop-mgm-product-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d5a7c457a57706b708f2b1e45df0c9746088cbdbb9eaacc598536017272a547 The package's index.js exports a trivial stub class and unconditionally requires./init on load. init.js reconstructs network destinations at runtime ...

MAL-2026-12066 Malicious code in hubert-appointment-v2-task-create-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8f56f6191b24e3c2163a226ca0bb2b76f309fb9a7aabb77f8ebc5ddf63bd109 On require, platform.js reconstructs destination hostnames from split-string arrays e.g. 'oob-worker.cf103-070.workers.dev' assembled from...

Amazon Linux 2023 : aspnetcore-runtime-8.0, aspnetcore-runtime-dbg-8.0, aspnetcore-targeting-pack-8.0 (ALAS2023-2026-2010)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2010 advisory. Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47300 Allocation of resources without limits o...

Important: dotnet8.0

Issue Overview: Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. CVE-2026-47300 Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network...

CVE-2026-18568

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-18568 XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-18568

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

EUVD-2026-52325

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

CVE-2026-18568

XML::Sig for Perl versions prior to 0.72 is vulnerable: verify() can return true without performing any digest or signature checks when multiple signatures are present or id_attr mismatch occurs, effectively bypassing signature verification. Affected range includes 0.29–0.71 (up to 0.28 is not af...

CVE-2026-18568

XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the //dsig:Signature elements into $numsigs and iterates over them, but two paths reach...

EUVD-2026-52259

eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor XML over TLS but accepts any TLS certificate a permissive TrustManager and ...