Malicious code in homestack-cheer (npm)

Source: amazon-inspector f475cd8b8a3e1dd4563ca0b20d85fde83576ed78c27eb91ca1cd77fbebe0d142 The package is published as homestack-cheer with description 'JS lib support cheerleading', but the README and the UMD build dist/my-lib.umd.js present it as a trivial hello-world 'greet' library. The ESM...

Malicious code in credit-card-input (npm)

The package communicates with a domain associated with malicious activity. --- Credit: OpenSSF source...

CVE-2026-4394

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Credit Card field's 'Card Type' sub-field input.4 in all versions up to, and including, 2.9.30. This is due to the getvalueentrydetail method in the GFFieldCreditCard class outputting the card type value...

CVE-2026-4394

Gravity Forms for WordPress (<= 2.9.30) is vulnerable to unauthenticated stored XSS via the Credit Card field’s Card Type sub-field (input_.4). The get_value_entry_detail() method outputs the card type value without escaping, while get_value_save_entry() accepts and stores unsanitized input fo...

Malicious code in credit-card-input (npm)

The package communicates with a domain associated with malicious activity...

Oracle VM VirtualBox Full Control

The vulnerability of the Core component of the Oracle VM VirtualBox software relates to the double memory release during the processing of input/output messages from the smart card. Exploiting this vulnerability allows an attacker to gain full control over the application by sending specially...

PT-2022-5337 · Oracle +1 · Virtualbox +1

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 6.1.40 Description: The issue is related to a double free memory error when handling smart card input/output messages in the Core component of Oracle VM VirtualBox. This can be exploited by a remote...