Malicious code in chai-as-balanced (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 562ae39db73c30faea0a6d84cda0fe0b68d60d7bfa863f769edcdb620e30b0a1 chai-as-balanced is a typosquat of chai-as-promised also impersonating pino via README/badges/exports that ships a remote code execution dropper...

Malicious code in chai-deflect (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4328eb627063ce40813ae27e3cb7ec1a967d17aa6c2bf045f0083d42e09352ea On require'chai-deflect', index.js top-level invokes launchDeflectBootstrap which detaches a child process running lib/caller.js. caller.js issues an...

CVE-2026-15189 aerostackdev aerostack-mcp mcp-whatsapp upload_media server-side request forgery

A security vulnerability has been detected in aerostackdev aerostack-mcp up to 6315dfde7df0a15aaf743f88d91347115e09ba23. Affected by this issue is the function uploadmedia of the component mcp-whatsapp. Such manipulation of the argument mediaurl leads to server-side request forgery. The attack ma...

CVE-2026-15189

The vulnerability CVE-2026-15189 affects aerostackdev aerostack-mcp (mcp-whatsapp component). The issue is in the upload_media function where manipulation of the media_url argument enables server-side request forgery (SSRF). The records indicate the attack could be launched remotely, with no vers...

Malicious code in chai-as-smart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbeb8dc929ba80789f3386d489e22fc4efa5fa43b2901a4d6aa8524c03168a58 On require, index.js spawns lib/initializeCaller.js as a detached background process. That script decodes a base64-hidden URL...

CVE-2017-7253

creationtimestamp| type| source ---|---|--- 2026-07-09 15:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq7vx533e625...

CVE-2026-4256

creationtimestamp| type| source ---|---|--- 2026-07-09 14:52:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7v5f3nus2i...

CVE-2026-12593

creationtimestamp| type| source ---|---|--- 2026-07-09 14:47:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7uugogut2k...

CVE-2026-15173

creationtimestamp| type| source ---|---|--- 2026-07-09 14:35:14+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq7u64nhfe25...

CVE-2026-15172

creationtimestamp| type| source ---|---|--- 2026-07-09 14:35:14+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq7u64nhfe25...

CVE-2026-6352

creationtimestamp| type| source ---|---|--- 2026-07-09 14:35:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq7u5w5rz72o...

CVE-2026-8472

creationtimestamp| type| source ---|---|--- 2026-07-09 14:35:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mq7u5w5rz72o 2026-07-10 17:44:35+00:00| seen| https://bsky.app/profile/qiancx.bsky.social/post/3mqcp7nooid2k 2026-07-10 17:44:39+00:00| seen|...

CVE-2026-58305

creationtimestamp| type| source ---|---|--- 2026-07-09 12:42:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7ntwij7b2i...

CVE-2017-2847

creationtimestamp| type| source ---|---|--- 2026-07-09 12:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq7nkvy5hh2s...

CVE-2017-2846

creationtimestamp| type| source ---|---|--- 2026-07-09 12:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mq7lvbi36e2o...

CVE-2026-7830

creationtimestamp| type| source ---|---|--- 2026-07-09 11:37:56+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mq7kb3luk22s...

CVE-2026-5955

creationtimestamp| type| source ---|---|--- 2026-07-09 10:52:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq7hp5hsn72h...

CVE-2026-47831

creationtimestamp| type| source ---|---|--- 2026-07-09 08:46:32+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq7aomhpfa2q 2026-07-09 17:36:49+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqa6cspnal2i...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-14245

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 5.5.1. This is due to the umresetpasswordprocesshook function performing no server-side...