Malicious code in @lyxa.ai/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a32d4762c92b12ad7fd0567dfa0f07470a01884303acdc7a3585bfb4ad7fff2 The exported bootstrapCore unconditionally initializes the event bus with a hardcoded amqps:// URL containing embedded credentials for the author's...

CVE-2026-70637

creationtimestamp| type| source ---|---|--- 2026-08-06 16:14:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/dfebd4n6mb6sx...

CVE-2026-65573

creationtimestamp| type| source ---|---|--- 2026-08-06 16:12:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msggn3kn6l2m...

CVE-2026-65553

creationtimestamp| type| source ---|---|--- 2026-08-06 16:08:30+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msggfx7l7n2p 2026-08-10 08:16:10+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mspnvqxdlh2r 2026-08-11 04:16:08+00:00| seen|...

CVE-2026-65546

creationtimestamp| type| source ---|---|--- 2026-08-06 16:06:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msggcd7m3t2o 2026-08-12 00:16:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msttzaxsnp2a...

CVE-2026-70646

creationtimestamp| type| source ---|---|--- 2026-08-06 16:00:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msgfza4pbj2n...

CVE-2026-65520

creationtimestamp| type| source ---|---|--- 2026-08-06 15:56:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msgfqjds452f 2026-08-06 23:14:04+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3msh67njzkv26 2026-08-06 23:14:06+00:00| seen|...

CVE-2026-28139

creationtimestamp| type| source ---|---|--- 2026-08-06 15:54:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msgfmvphqq2m...

CVE-2026-53975

creationtimestamp| type| source ---|---|--- 2026-08-06 15:52:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msgfjd25gq22...

CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

CVE-2026-53983

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

CVE-2026-18359 Server-Side Request Forgery (SSRF) in eScriptorium

Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the metsuri or iiifuri parameter o...

CVE-2026-18427

creationtimestamp| type| source ---|---|--- 2026-08-06 14:59:17+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3msgckuh2w226 2026-08-06 20:00:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msgtfyoa4h2n...

CVE-2026-68747 CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other...

EEF-CVE-2026-68747 CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

Summary Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to...

EUVD-2026-54080

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...

CVE-2026-12605

creationtimestamp| type| source ---|---|--- 2026-08-06 14:42:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msgbm65koi2i 2026-08-11 03:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3msrn426pqz2u...

CVE-2026-5134

creationtimestamp| type| source ---|---|--- 2026-08-06 14:42:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msgbm4uoar2l...

Malicious code in diezyyasha-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a8260f399be3238031864bd71945720155775a2de8e952a25225337257fd745 diezyyasha-baileys is a fork of the Baileys WhatsApp library that contains an obfuscated network destination in lib/Socket/messages-send.js. At lines...