CVE-2025-66974

An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a Denial of Service DoS or connection to an attacker-controlled device via supplying a crafted packet during the provisioning phase...

CVE-2026-22056

StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher are susceptible to a Denial of Service vulnerability when deployed in a non-standard configuration and scenario. A successful exploit allows an attacker with low privileges and some control over the environment to cause a partia...

Malicious code in classlink-2t2ozsy0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e54446d6dfae0323294573f028ce0f4cf62afd9794b669c4f7733b3937fdffb9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bigops-shared-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2864e806fc8b9b1002cc51dc96a78aa9084f3d8ce133fc636ac21372c3cdfb59 On require of bigops-shared-ui, index.js loads./setup, which downloads a native executable from obfuscated Cloudflare Workers endpoints...

MAL-2026-12603 Malicious code in checkout-use-toasts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bed98d203bbb9cb1a915db70566cfe33eb063a59e97c1e2f7607164b5a9c312e On require of checkout-use-toasts, index.js loads bridge.js which fetches an OS/architecture-specific native binary from runtime-assembled Cloudflare...

Malicious code in scrollbar-hide-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f19e1731b591552a096b108703702b9663c1bbb8cf9c2ff6fc048f8582e8607 The package's main entry dist/index.js appends an obfuscated payload — wrapped in evalatob... with require targets and URLs hidden in \uXXXX escapes ...

Malicious code in tailwind-animate-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7eb20d422c7053793a78e3d898bef2d97269318be88f147d60c7d036d2d23144 index.js appends a large base64-encoded, unicode-escaped payload after 11 KB of whitespace padding, executed via evalatob'...' whenever the package i...

MAL-2026-12138 Malicious code in agent-bot-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 299eb5fe496022e888ed0663d0be82ddb8fac108bcb9a223291449982c360530 Package establishes a persistent remote-access channel to the hardcoded server https://server.junofficial.biz.id. On load, the client posts the...

MAL-2026-12205 Malicious code in simple-date-formatter-util-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6ec6c790f702e0bb6617bb6bf16ad8b3a154bc7d539938535cde7a2cf205f17 The package's npm postinstall script curls cloud instance-metadata endpoints AWS 169.254.169.254, Alibaba 100.100.100.200, Tencent...

CVE-2026-9487

XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. getsignedxml in lib/XML/Sig.pm, called from verify, resolves the SignedInfo Reference/@URI to a node with the XPath expression "//@ID='$id'" and returns the first node of the resulting node set. A document in which...

Allocation of Resources Without Limits or Throttling

Overview org.bouncycastle:bcprov-ext-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12...

CVE-2026-18536

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches...

SUSE CVE-2026-63923

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvumboxhandlerrepeventnotify rvumboxhandlerrepeventnotify in drivers/net/ethernet/marvell/ octeontx2/af/rvurep.c queues a sender-controlled REPEVENTNOTIFY request body verbatim, and...

CVE-2026-58195

Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts,...

CVE-2026-47997 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control...

MAL-2026-10103 Malicious code in optimize-regex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b77c2c0dab050d3a675407d74b649c73bfc107da05191cf041fb66e0346073a package.json declares optimize-regex as a dependency and devDependency of itself, resolved via a plain-HTTP tarball URL at...

CVE-2026-44454

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7 and 2.30.2, the dotfiles registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. Any user who supplied a craft...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the coder open app process. An attacker can obtain a user's session token and impersonate their account by crafting a malicious external app URL containing a session token placeholder, which is then replaced with the...

MAL-2026-10222 Malicious code in @flex-ng/filter-pipe (npm)

The @flex-ng/filter-pipe package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization the @flex-n...

axios: Axios: Information disclosure due to prototype pollution vulnerability

A flaw was found in Axios, a promise-based HTTP client. This vulnerability involves prototype pollution gadgets in the request configuration processing. If another vulnerability has already polluted the Object.prototype.transformResponse, affected Axios versions may incorrectly interpret this...