MAL-2026-13004 Malicious code in bnpl-blocks-mobile-bnpl-separator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a76b1d07f3d0357fa471ba2b1e5a0052b1b789f96763446a20e19cf7ac7ab11 On require of the package, index.js loads bootstrap.js which fetches a platform-specific binary payload over HTTPS from author-controlled hosts whose...

Malicious code in checkout-mobile-input-email (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9c13bf58568e58ecec010552f23cd8eb27cef188f4ed0c905e832fa0f8d0372 On require'checkout-mobile-input-email', index.js loads helpers.js which assembles hostnames via string-array.join"" e.g...

Malicious code in checkout-storage-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f7fafdc9e8a39ce001b1628d38a347c50fce7e33365550cf1dcb1d3e3014df1 On require of checkout-storage-service, helpers.js selects a platform-specific endpoint and downloads bytes over HTTPS from a rotating list of...

MAL-2026-12590 Malicious code in checkout-resend-pos-order-sms-am (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d2c64d2c4df678c1c10b1ca9d9f386e8fd6dd9afe0cb804b11b9dff736ab11 On require of this package, index.js loads polyfill.js which reconstructs attacker-controlled hostnames via array-join concatenation e.g...

Malicious code in clients-structure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc3674a31787baaf2d3d554336f507ecce91da7b4d527a170c50cd720024d48 On require of clients-structure, index.js loads ext.js which selects a platform-specific endpoint, fetches a binary from a rotating list of anonymous...

MAL-2026-12773 Malicious code in devplatform-spa-plugin-notifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 877337509f36ab52fcfb93d1dc48d77439a5154d077fc047b7263265cfb71468 On module load, index.js requires bootstrap.js which selects a platform-specific asset, downloads an opaque binary from hardcoded Cloudflare Workers...

Malicious code in devplatform-spa-plugin-thermostat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe54d9f541a205ad779acf3da6216c85ec0e20b6a502aaff03dc88b7cf2d85c7 On require, index.js loads compat.js which selects a per-platform payload path, downloads a binary over HTTPS from rotating Cloudflare Workers...

Malicious code in pvm-autodoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4f92e3ecba043a713f37e35f3162b1454e17991b2860c0923a6aa8fced87c6d On require'pvm-autodoc', index.js loads bridge.js which downloads a platform-specific native binary from one of four hardcoded Cloudflare Workers...

Malicious code in accounts-forms (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f17174f805fda0f57e8b471b2a788e92836a2c20d5da22e818ed43218503b0ed On require of accounts-forms, index.js loads polyfill.js which selects a platform-specific URL and downloads an opaque binary over HTTPS from hardcod...

Malicious code in tinkoff-statist-browser-typed-client-investing.product.pulse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17004ada8eaa4739f6095affbf19161081358a290ddfa0d0e8ff92a11436e731 The package's main entrypoint index.js unconditionally requires bootstrap.js, which downloads a platform-specific executable from a rotating list of...

MAL-2026-12148 Malicious code in bigops-api-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acd531683a48496b0b96d04fb0264b4e49f46d43a099af7172bd259c20bf7bcc On require of the package, index.js loads runtime.js which selects a platform-specific endpoint from a list of Cloudflare Workers subdomains...

MAL-2026-12034 Malicious code in beaver-ui-form-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37c4d60b5b32e6639dcecb7661afe72c6f5bb9ce486e53a398e81e11932f7379 On require'beaver-ui-form-modal', index.js loads shim.js which downloads a platform-specific binary from string-array-obfuscated Cloudflare Worker...

Incorrect Behavior Order: Validate Before Canonicalize

Overview Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the SetCookie::matchesDomain. An attacker can gain unauthorized access to sensitive information or manipulate session state by exploiting noncanonical domain representations in...

CVE-2026-69245 Guzzle: Noncanonical cookie domain keeps subdomain scope

Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain recognizes the Domain as an IP literal or a numeric host, and the decision comes from the domain's own text, so two...

CVE-2026-67293

FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in libfreerdp/crypto/tls.c treats a wildcard pattern such as .example.com as matching any hostname ending in .example.com, so it incorrect...

UBUNTU-CVE-2026-67293

FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in libfreerdp/crypto/tls.c treats a wildcard pattern such as .example.com as matching any hostname ending in .example.com, so it incorrect...

CVE-2026-67293

FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in libfreerdp/crypto/tls.c treats a wildcard pattern such as .example.com as matching any hostname ending in .example.com, so it incorrect...

CVE-2026-67293

FreeRDP prior to 3.29.0 (affected versions ≤ 3.28.0) contains an improper certificate hostname validation vulnerability. The TLS hostname matcher (tls_match_hostname() in libfreerdp/crypto/tls.c) treats a wildcard pattern such as *.example.com as matching any hostname ending in .example.com, allo...

EUVD-2026-51860

FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in libfreerdp/crypto/tls.c treats a wildcard pattern such as .example.com as matching any hostname ending in .example.com, so it incorrect...

CVE-2026-67293

FreeRDP before 3.29.0 affected versions = 3.28.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher tlsmatchhostname in libfreerdp/crypto/tls.c treats a wildcard pattern such as .example.com as matching any hostname ending in .example.com, so it incorrect...