MAL-2026-5747 Malicious code in @giftyhq/widget-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ad3f12a6a12fbfa60e4a72747df6974f89906200568926b99a8c93c489b5e62 package.json declares "preinstall": "node index.js", which fires automatically on npm install. index.js collects host fingerprinting data —...

CVE-2026-54358

creationtimestamp| type| source ---|---|--- 2026-06-13 20:51:39+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116744774971353040...

Malicious code in environment-gate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80dc74c6c5240e9c146e476300b44582cc114cf1827319ba81d2bcae2d64c2cf index.js contains a commented-out line that, if uncommented, would base64-decode the URL https://www.jsonkeeper.com/b/VKUNI, fetch its contents via...

MAL-2026-5743 Malicious code in environment-gate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80dc74c6c5240e9c146e476300b44582cc114cf1827319ba81d2bcae2d64c2cf index.js contains a commented-out line that, if uncommented, would base64-decode the URL https://www.jsonkeeper.com/b/VKUNI, fetch its contents via...

GHSA-48C2-RRV3-QJMP

creationtimestamp| type| source ---|---|--- 2026-06-13 19:28:58+00:00| seen| https://gist.github.com/konard/8c3e52dfd7019783fb2c7f9392d36d2c...

CVE-2026-6428

SQL Injection in reports/catalogueout.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary da...

CVE-2026-9134

creationtimestamp| type| source ---|---|--- 2026-06-13 09:48:11+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo5xyvp7al2o 2026-06-14 12:03:34+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116748361037241500...

web-vuln-scanner

Web Vulnerability Scanner Basic web application vulnerability...

Malicious code in class-synth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1aa63407d7400b4819d0739dedad0a32d9ae29b18509693c2e8763cf30275271 class-synth is advertised as a small class/style/date utility library, but its main entry dist/index.js contains a hidden top-level async IIFE init...

MAL-2026-5730 Malicious code in class-synth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1aa63407d7400b4819d0739dedad0a32d9ae29b18509693c2e8763cf30275271 class-synth is advertised as a small class/style/date utility library, but its main entry dist/index.js contains a hidden top-level async IIFE init...

GHSA-PV9G-RRHQ-MPQC

creationtimestamp| type| source ---|---|--- 2026-06-13 05:17:38+00:00| seen| https://mastodon.bsd.cafe/users/grahamperrin/statuses/116741102400640422...

CVE-2026-54228

creationtimestamp| type| source ---|---|--- 2026-06-13 04:04:22+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo5ekrdf372d 2026-06-13 06:56:18+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mo5ofk7ow52m...

Malicious code in vite-config-optimizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f824c077d7d2705d17dc29eba9a24ea8b51b93785bcf83fdfe639fc8f9bc581f package.json declares a postinstall hook node -e "require'./loader.js'" that auto-executes on every npm install. loader.js spawns a detached child No...

MAL-2026-5727 Malicious code in vite-config-optimizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f824c077d7d2705d17dc29eba9a24ea8b51b93785bcf83fdfe639fc8f9bc581f package.json declares a postinstall hook node -e "require'./loader.js'" that auto-executes on every npm install. loader.js spawns a detached child No...

CVE-2026-6428: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection in reports/catalogueout.pl in Koha Community Koha through 22.11.37, 23.x, 24.x before 24.11.16, 25.05.x before 25.05.11, 25.11.x before 25.11.05, 26.05.x before 26.05.01, and 26.11.x before 26.11.00 allows an authenticated staff user with the Reports module flag to read arbitrary da...

CVE-2026-12130

creationtimestamp| type| source ---|---|--- 2026-06-12 22:55:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo4tjwiuka2j...

CVE-2026-42851

creationtimestamp| type| source ---|---|--- 2026-06-12 22:20:14+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mo4rkr3aqf2m 2026-06-13 10:04:29+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo5yph3aqi2y 2026-08-09 18:21:53+00:00| seen|...

CVE-2026-54395

MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler using HTML escaping inside a single-quoted JavaScript string. Because browsers HTML-decode attribute values before JavaScript parsing, a...

CVE-2026-53523 Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path, with zero...

CVE-2026-53523 Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to before version 2.2.0, the getRedirectURL function in oauth2.go:22-29 constructs the OAuth2 callback URL by concatenating the request's Host header with a fixed path, with zero...