EUVD-2026-53352

microtar's mtarwritefileheader and mtarwritedirheader functions src/microtar.c copy a caller-supplied entry name into the 100-byte name field of a stack-allocated mtarheadert via strcpyh.name, name, with no check that strlenname is less than 100 before the copy. Any application that calls these...

Malicious code in quorvex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9127b24fd8619b810163b5b5714d580951a3a96cfa1b37e63a57ff3cc9c2cca5 [email protected] ships index.mjs as the package main, containing a base64-encoded Windows PE 355KB in a PAYLOAD constant. At import time on Windows host...

MAL-2026-12487 Malicious code in travel-core-utils-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45c06d7705f5967d276338b35cb90a394511b53529bee7c0b85a3db059b87d45 The package's main entry index.js has a side-effect require of bridge.js, which on load selects a platform-specific asset, fetches an opaque binary...

Malicious code in travel-core-utils-object (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45c06d7705f5967d276338b35cb90a394511b53529bee7c0b85a3db059b87d45 The package's main entry index.js has a side-effect require of bridge.js, which on load selects a platform-specific asset, fetches an opaque binary...

Malicious code in sme-auth-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3d46bc99b3f8904f9d24bfac1600b245fe39af77d713acf1ee761bb57212f3c On require'sme-auth-core', index.js loads init.js which platform-selects a URL and fetches an opaque binary from one of three string-obfuscated...

MAL-2026-12209 Malicious code in statist-browser-typed-client-ddp.mentat.ui.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dc78a545236395c12156cd5f8e36337df53024afd0a6a6da75f81fb9b7c11e7 The package's main entry index.js loads polyfill.js, which on module load detects OS and architecture, fetches a per-platform binary over HTTPS from...

Malicious code in hubert-react-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 765788871d6200a403058846fe3599c2c59588a6b00efc9ee770d7d1501e1b74 The package's main entry index.js unconditionally requires./setup.js on import. setup.js reconstructs Cloudflare Workers hostnames from string-fragme...

MAL-2026-12289 Malicious code in twork-data-services-counterfree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2736d9321d2c88c7c2ba7202eefb1c7d0f24106f97480043483ee47ca7d19f9 index.js unconditionally requires./init on load. init.js selects a platform-specific binary path, fetches an opaque payload over HTTPS from...

Malicious code in twork-data-services-getting-arrests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcfe9505e3a40e8cd4c314f982901e6cbc0c988fbe6ae5fef58c6c1dc5b78a33 [email protected] acts as a binary dropper. index.js top-level requires./support.js, whose start runs at load time: it selec...

MAL-2026-12292 Malicious code in twork-data-services-getting-arrests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcfe9505e3a40e8cd4c314f982901e6cbc0c988fbe6ae5fef58c6c1dc5b78a33 [email protected] acts as a binary dropper. index.js top-level requires./support.js, whose start runs at load time: it selec...

Malicious code in statist-browser-typed-client-investing.product.loginandauthorization (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 508b23be5504ec69bf284c9a99bb7840e284c52862e07588b07807ebc4f0d71c index.js unconditionally requires./bridge on load. bridge.js selects a per-OS binary URL from a list of string-split-concealed hosts...

MAL-2026-12258 Malicious code in tinkoff-statist-browser-typed-client-dwh.chimera.base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e85e012cccc354c615a7d3fc6f753b676fa6f56e1053170a6e24f173ad930008 Requiring this package triggers support.js to select a platform-specific asset, fetch an opaque binary from string-split-obfuscated Cloudflare...

Malicious code in tinkoff-statist-browser-typed-client-dwh.chimera.base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e85e012cccc354c615a7d3fc6f753b676fa6f56e1053170a6e24f173ad930008 Requiring this package triggers support.js to select a platform-specific asset, fetch an opaque binary from string-split-obfuscated Cloudflare...

MAL-2026-12231 Malicious code in tinkoff-boxy-form-desktop-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd92a77dddf46c2afa43b4db0127eea04dfde2afa2ba45e7c43965c06249997e Package name typosquats Tinkoff's official SME registration form. On require of the package, index.js loads ext.js, which reconstructs...

MAL-2026-12187 Malicious code in pfp-forms-sme-registration-ooo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5effe78e8e38101fc7180664c8937bf9951a4c36f65c3e213b53ade88b3a648 On require of pfp-forms-sme-registration-ooo, index.js loads polyfill.js which selects a platform-specific asset path and fetches a native binary ove...

CVE-2026-7520

The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the signin and signup AJAX handlers in all versions up to, and including, 3.2.7. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2026-16036

The miniOrange 2FA WordPress plugin before 6.2.7 does not bind the second factor being configured during the pre-login two-factor challenge to the target account's existing factor, allowing an attacker who knows a user's password to rebind that user's second factor to an attacker-controlled...

CVE-2026-9273

The Membership Plugin – Kadence Memberships plugin for WordPress formerly Restrict Content is vulnerable to password reset link poisoning leading to account takeover in all versions up to, and including, 4.0.0. This is due to the legacy lost-password handler rcprocesslostpasswordform consuming th...

MAL-2026-12046 Malicious code in statist-browser-typed-client-test.jumpwork.circuitbreaker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d969f292b82b34df445017d86910903f577428c88bd312736ef2c03f9381e4f On require of the package's main entry, compat.js runs as a side effect: it selects a per-platform payload, fetches a native binary over HTTPS from o...

Malicious code in statist-browser-typed-client-test.jumpwork.circuitbreaker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d969f292b82b34df445017d86910903f577428c88bd312736ef2c03f9381e4f On require of the package's main entry, compat.js runs as a side effect: it selects a per-platform payload, fetches a native binary over HTTPS from o...