CVE-2026-19023 HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...

Malicious code in dolyame-boxy-desktop-bnpl-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44d48270624de1daefb72838205deed5f5ad8e91d15d34e8b953a15367d02945 On require of the package, runtime.js selects an OS/arch-specific payload linuxx64, linuxarm64, darwin, win32, downloads a binary from...

MAL-2026-12829 Malicious code in bi-core-bi-core-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a6c642622497cec2ce5317e0e3e7e44f94b3832db9c06e13d336b5387009f1 On require of the package, index.js triggers compat.js which selects a per-platform binary path, downloads bytes from runtime-assembled...

Malicious code in bigops-telephony-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93b10fc5eff860f82de5bc03b910dbe2b96b06d54c22741cbb593b007dd9ee38 On require of the package, shim.js downloads a platform-specific executable over HTTPS from string-concatenated hostnames...

Malicious code in bnpl-blocks-atom-bnpl-navigation-arrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac730391d7dd3e3b320792e22983d3d225a08701364594a2db02d8c19f1bf868 Requiring this package executes platform.js, which detects the host OS/arch, fetches an opaque binary from one of four author-controlled Cloudflare...

MAL-2026-12797 Malicious code in multi-reqs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38937963f906d0bf3b4dac24a1a45f574aeb53cd2f268ffb9730d88bedf50bce The package's default export accepts token, password arguments and POSTs them, formatted as a Discord embed titled 'Yeni Hesap Bilgisi' with fields '...

Malicious code in streak-math-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5ca17a73b4b4b7a21d7ccbad12df26ca3c6ad524689f2e1520bd34724b61fbb On module import, index.js decodes a hex-obfuscated string table to reconstruct a Backblaze B2 URL and a set of Windows filesystem paths, then gates...

Malicious code in streak-math-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ba4f1a9b23ca375fed98868d8ca488ec722b473060834412b0b1b23f5cae37a [email protected] is advertised as a math primitives library but its index.mjs top-level IIFE bootstrap runs on any import and drops a hex-embedd...

Malicious code in twork-data-services-role-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc0980e765a4c7250c1ac7ca327daefbe85544498883193c5f5019b08c06b8ec On require, index.js loads init.js which downloads a platform-specific executable from hardcoded Cloudflare Workers hosts assembled via split-string...

Malicious code in tinkoff-statist-browser-typed-client-sme.rko.authorization.common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 698cb702f4e52ddb67226e8681dc3a11228f43cd11b47516329e16b8ae3de436 The package typosquats an internal Tinkoff scope name. On require, index.js loads init.js, which builds attacker hostnames at runtime from...

MAL-2026-12270 Malicious code in tinkoff-statist-browser-typed-client-sme.platform.mobile.dynamicteasers.common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd094a1c3c67af1fc7372e62ed565847fcf26962f3b90e53a5df200390c07a99 On require/import, index.js loads bridge.js which selects a platform-specific endpoint and downloads an opaque executable over HTTPS from hardcoded...

CVE-2026-71243: Improper Neutralization of Special Elements used in an OS Command

The backmeup npm package assembles shell command strings by directly concatenating its option values name, source, destination, filter - e.g. cmd = "mkdir -p " + path.joininfo.destination, info.name + "; " - and executes the resulting string through a shell via ssh2-exec locally via childprocess,...

faraday: Faraday: Denial of Service via crafted nested query strings

A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application t...

faraday: Faraday: Denial of Service via crafted nested query strings

A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application t...

faraday: Faraday: Denial of Service via crafted nested query strings

A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application t...

faraday: Faraday: Denial of Service via crafted nested query strings

A flaw was found in Faraday, an HTTP client library. The Faraday::NestedParamsEncoder, which handles nested query parameters, does not limit the depth of nested query strings during decoding. A remote attacker can exploit this by sending a specially crafted query string, causing the application t...

CVE-2026-14838

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

EUVD-2026-52652

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-14838

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

PT-2026-67685

Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...