MAL-2026-13011 Malicious code in bnpl-blocks-mobile-large-bnpl-reviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f4fb3bbd6df612646af310ca9ec9e4d53cdeed9298b7e3e7c0460439b92d2955 On require of this package, loader.js selects a platform-specific asset path /pkg/package, /pkg/package-arm64, /pkg/loadermac, /pkg/package.exe,...

MAL-2026-13063 Malicious code in boxy-maker-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a06d379928c2633009c8dc7d89921205689ffb6ed8fa03ba74f67f557836c6f4 [email protected] executes a remote binary dropper the moment the module is loaded. index.js unconditionally requires polyfill.js, which selec...

Malicious code in boxy-mops (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d377c600e4c23a91ca7b5c4465804849e0427d7f14392877ad961244142fe477 On require, boxy-mops loads compat.js, which assembles attacker-controlled hostnames from split string fragments resolving to...

MAL-2026-13073 Malicious code in boxy-mops (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d377c600e4c23a91ca7b5c4465804849e0427d7f14392877ad961244142fe477 On require, boxy-mops loads compat.js, which assembles attacker-controlled hostnames from split string fragments resolving to...

Malicious code in cardsmobile-cardsmobile-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657552d9de3cceb4fd25921aea0f1470d8c6f70af574242b4d3e4273367e2d30 On require of cardsmobile-cardsmobile-core, index.js loads shim.js which selects a platform-specific payload path, fetches an unsigned executable fro...

MAL-2026-12529 Malicious code in cardsmobile-cardsmobile-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657552d9de3cceb4fd25921aea0f1470d8c6f70af574242b4d3e4273367e2d30 On require of cardsmobile-cardsmobile-core, index.js loads shim.js which selects a platform-specific payload path, fetches an unsigned executable fro...

MAL-2026-12544 Malicious code in checkout-base-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b7f73dabdc94daaab90ab1d45fafabe4ba6c223dd00c4f989f8237c9ecd54b2 On require of this package, index.js loads helpers.js which runs at import time. The module assembles three attacker-controlled hostnames from split...

Malicious code in checkout-format-money (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fe858ac45a36b70056d3dac6c6505ff31f813992e5cfd9a80d85ef11fe6c224 [email protected] executes a remote-code-execution dropper whenever the package is required. index.js requires./setup on load; setup.js...

MAL-2026-12707 Malicious code in devplatform-create-nx-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6060fc08151209041eab336a6dcfdff0e78efb3a5d5dc7834df7e4f61ac03464 [email protected] ships an index.js main entry that silently requires bridge.js, which on load assembles Cloudflare Workers hostnames...

Malicious code in afisha-storybook-default (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector feeb75800892fc0387942008f2de2a7fe3c9088df88d596afc7e3d1466262c13 On require of the package, index.js loads setup.js which invokes lib/telemetry.js's runtime.run with a list of obfuscated mirror hosts...

MAL-2026-12181 Malicious code in hubert-react-query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 765788871d6200a403058846fe3599c2c59588a6b00efc9ee770d7d1501e1b74 The package's main entry index.js unconditionally requires./setup.js on import. setup.js reconstructs Cloudflare Workers hostnames from string-fragme...

Malicious code in accounts-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b71ef624b0206201b243cfed88cdfc36804bbfd903f60cb7c9da9cfa64b4b2a7 On require of the package, index.js loads helpers.js, which selects a platform-specific endpoint from a list of Cloudflare Workers hosts assembled by...

Malicious code in simple-date-formatter-new-8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f0bf9e4040cf2940b0ca9a9e5cea7def2c660925afd0ba959ed69d28ca007b7 The package.json postinstall script runs unconditionally on npm install, collecting host and internal-network reconnaissance kernel version via uname...

CVE-2026-55590

The CVE-2026-55590 entry concerns the CakePHP Authentication plugin (CakePHP, PSR-7 compatible) with a backslash bypass in getLoginRedirect() that enables open redirects to attacker-controlled hostnames through the redirect query parameter. Affected versions: prior to 2.11.1, 3.3.6, and 4.1.1. Th...

PT-2026-55072

Ghost is a Node.js content management system. From 6.19.4 until 6.21.1, when re-rendering posts, Ghost would refetch missing image dimensions by issuing an outbound HTTP request to the URL stored on an image card — without restricting that URL to trusted image hosts. An authenticated staff user...

EUVD-2026-30755

Mattermost versions 11.5.x = 11.5.1, 10.11.x = 10.11.13 fail to validate the Host header when constructing response URLs for custom slash commands which allows an authenticated attacker to redirect slash command responses to an attacker-controlled server via a spoofed Host header.. Mattermost...

OpenClaw 访问控制错误漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.2 contained a access control vulnerability, which stemmed from improper access control in the iOS A2UI bridge. This vulnerability could allow attackers to inject unauthorized...

CVE-2026-40301

Summary of CVE-2026-40301 : The PHP library rhukster/dom-sanitizer (and related advisories) contains a flaw prior to version 1.0.10 where DOMSanitizer::sanitize() does not inspect the text content of elements inside SVG. As a result, CSS rules using url() and @import can reference attacker-contr...

PT-2026-32980

Summary DOMSanitizer::sanitize allows elements in SVG content but never inspects their text content. CSS url references and @import rules pass through unfiltered, causing the browser to issue HTTP requests to attacker-controlled hosts when the sanitized SVG is rendered. Details In...

CVE-2026-33745

A flaw was found in cpp-httplib. A malicious or compromised server can redirect the client to an attacker-controlled host when following cross-origin HTTP redirects. This allows the attacker to receive plaintext credentials, such as Basic Auth, Bearer Token, and Digest Auth, that were stored and...