MAL-2026-14014 Malicious code in try-lock-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 941a65c056bbb40a20dd7b1f4107bf804df157df12ea0b89067fc6770afe3b6b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in single-flight-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbe4ec28aff41ab4793722dc5975c5639762d2dc2ed23827d71d410283993ca4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in async-critical-section (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 933cc6900114e5aef5a4b89e0c20c0242cf368b5322cf260ae395c75cc97552f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in resource-lease-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731d4ed32c1947117f9e7243c0179f5076213414505bf38176e660653df025f1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14008 Malicious code in resource-lease-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731d4ed32c1947117f9e7243c0179f5076213414505bf38176e660653df025f1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in lock-deadline-guard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d91ecfa280d3545a23564aca4ee8787aae8cf03a44a3133ffb54b21184f7d13 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-13955 Malicious code in mutex-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e6d6c8a6e7f9463fa8a07604b4699b1dba8415ee6759e3145b0cab183f4421 The package presents itself as a mutex/semaphore library but contains a hidden second-stage loader in lib/Mutex.js. When runExclusive is invoked with...

Malicious code in keyed-mutex-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd45a0cb60ef881a4f011fed410aacced4d83f39457bea6c4f21fa7d09076801 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in priority-mutex-lane (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4bd0cb794e1b53c6b4c63bdd456196771029c0c003a33694581dadd3707acf0e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14010 Malicious code in semaphore-job-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 894dd3724c09345add605b1ec247a8b2780a964fe89316f23fc0e57266ac35d7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-13998 Malicious code in async-critical-section (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 933cc6900114e5aef5a4b89e0c20c0242cf368b5322cf260ae395c75cc97552f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in semaphore-job-pool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 894dd3724c09345add605b1ec247a8b2780a964fe89316f23fc0e57266ac35d7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in mutex-forge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e6d6c8a6e7f9463fa8a07604b4699b1dba8415ee6759e3145b0cab183f4421 The package presents itself as a mutex/semaphore library but contains a hidden second-stage loader in lib/Mutex.js. When runExclusive is invoked with...

MAL-2026-14004 Malicious code in lock-deadline-guard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d91ecfa280d3545a23564aca4ee8787aae8cf03a44a3133ffb54b21184f7d13 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14003 Malicious code in keyed-mutex-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd45a0cb60ef881a4f011fed410aacced4d83f39457bea6c4f21fa7d09076801 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-73533

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...

Joomla com_installer update list stored XSS (description/detailsurl unescaped)

Joomla cominstaller Update List Stored XSS CVE-2026-48952 Vulnerability Overview The extension update list in the Joomla CMS administrative backend the update view of cominstaller renders the description and detailsurl fields of extension update information without HTML escaping, constituting a...

CVE-2026-73532

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...

CVE-2026-73532

Fluent Forms Pro 6.2.7 is affected by an embedded malicious-code vulnerability introduced via a tampered plugin build served from a decommissioned update server. A rogue PHP file, libs/class-license-sync.php, was loaded through a require_once in fluentformpro.php, creating a backdoor REST API end...

CVE-2026-73532 Fluent Forms Pro 6.2.7 Embedded Malicious Code via Tampered Plugin Build

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...