Malicious code in bnotify-web-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0861227aa2c7246f74708656f530b7f99a71f6e6e0be93a1ea7dc3b2d6c814d1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14551 Malicious code in bnotify-web-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0861227aa2c7246f74708656f530b7f99a71f6e6e0be93a1ea7dc3b2d6c814d1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @hubsync/web-sdk-react (npm)

npm/@hubsync/web-sdk-react is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

leanplum-sdk (1.13.0) potentially affected by CVE-2025-51684 via clevertap-web-sdk (1.9.2)

clevertap-web-sdk NPM version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on clevertap-web-sdk and may be impacted: - leanplum-sdk 1.13.0 Source cves: CVE-2025-51684 Source advisory: SNYK:JS-CLEVERTAPWEBSDK-18508175...

Cross-site Scripting (XSS)

Overview clevertap-web-sdk is a Affected versions of this package are vulnerable to Cross-site Scripting XSS in the renderCustomHtml function of src/util/campaignRender/nativeDisplay.js, which assigns the display.details0.html field from an incoming postMessage to element.innerHTML without...

CVE-2025-51684: Improper Neutralization of Input During Web Page Generation

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting XSS. The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of...

CVE-2025-51684

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting XSS. The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of...

CVE-2025-51684

The CleverTap Web SDK (version 1.15.1 ) is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. Specifically, the renderCustomHtml() function in src/util/campaignRender/nativeDisplay.js fails to sanitize untrusted data received via window.po...

CVE-2025-51684

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting XSS. The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of...

Malicious code in @mts-pay/web-sdk (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2026-6964

The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.6.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain...

CVE-2026-6964

The CVE-2026-6964 entry covers the WordPress plugin Video Conferencing with Zoom (versions up to 4.6.7). It states an authorization bypass in the get_auth AJAX action, allowing unauthenticated attackers to obtain the site’s Zoom SDK API key and a freshly-signed JWT usable with the Zoom Web SDK to...

EUVD-2026-37031

The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.6.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain...

PT-2026-49608

The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.6.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to obtain...

MAL-2026-5425 Malicious code in @oplus/obus-web-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 956ecc19633177f7ef9b458e6407ffbba6c8366688249c07bfd7f3c8e85c17a9 On npm install, the package's scripts/postinstall.js collects the installer's username os.userInfo, hostname os.hostname, current working directory...

CVE-2026-26861

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to Cross-Site Scripting XSS via window.postMessage. The handleCustomHtmlPreviewPostMessageEvent function in src/util/campaignRender/nativeDisplay.js performs insufficient origin validation using the includes method, which can be bypassed ...

leanplum-sdk (1.13.0) potentially affected by CVE-2026-26861 via clevertap-web-sdk (1.9.2)

clevertap-web-sdk NPM version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on clevertap-web-sdk and may be impacted: - leanplum-sdk 1.13.0 Source cves: CVE-2026-26861 Source advisory: SNYK:JS-CLEVERTAPWEBSDK-15366963...

leanplum-sdk (1.13.0) potentially affected by CVE-2026-26862 via clevertap-web-sdk (1.9.2)

clevertap-web-sdk NPM version 1.9.2 is affected by a known vulnerability. The following packages have a transitive dependency on clevertap-web-sdk and may be impacted: - leanplum-sdk 1.13.0 Source cves: CVE-2026-26862 Source advisory: OSV:GHSA-JFRQ-HJ9F-C8QX...

EUVD-2026-9039

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting XSS via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js lines 56-60 uses the includes method to verify the originUrl contains...

CleverTap Web SDK is vulnerable to DOM-based Cross-Site Scripting (XSS) via window.postMessage

CleverTap Web SDK version 1.15.2 and earlier is vulnerable to DOM-based Cross-Site Scripting XSS via window.postMessage in the Visual Builder module. The origin validation in src/modules/visualBuilder/pageBuilder.js lines 56-60 uses the includes method to verify the originUrl contains...