514633 matches found
CVE-2026-74951
creationtimestamp| type| source ---|---|--- 2026-08-19 04:45:46+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260819...
CVE-2026-74949
creationtimestamp| type| source ---|---|--- 2026-08-19 04:45:42+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260819 2026-08-20 09:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtix3ozgqv22...
CVE-2026-74948
creationtimestamp| type| source ---|---|--- 2026-08-19 04:45:40+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260819...
CVE-2026-74941
creationtimestamp| type| source ---|---|--- 2026-08-19 04:45:23+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260819 2026-08-20 11:07:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtj44msevn2y...
CVE-2026-74936
creationtimestamp| type| source ---|---|--- 2026-08-19 04:45:12+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260819 2026-08-20 21:10:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtk5sspqbr25...
CVE-2026-70408
creationtimestamp| type| source ---|---|--- 2026-08-19 04:45:05+00:00| seen| https://jvn.jp/en/jp/JVN47716829 2026-08-19 05:53:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/drxjlkjzlugcu 2026-08-19 06:00:23+00:00| seen|...
EUVD-2026-62230
The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the AVCFAbilitiesMedia::register replace-media-file executecallback function in all versions ...
Malicious code in luluking1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdd9bc7980d937f728e8beb92d789d75a1dc02fd56bdfb545cd33f255952bcf4 index.js stores a remote URL and a curl -sL -o command as numeric char-code arrays and reconstructs them at runtime with String.fromCharCode.apply,...
MAL-2026-14250 Malicious code in luluking1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdd9bc7980d937f728e8beb92d789d75a1dc02fd56bdfb545cd33f255952bcf4 index.js stores a remote URL and a curl -sL -o command as numeric char-code arrays and reconstructs them at runtime with String.fromCharCode.apply,...
Malicious code in npm-wold (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731c22e563f2ea15800d87f345de9b8363c0c715e9f39606201d47a8fb422ab1 [email protected] declares a postinstall script node dist/config.js that, on npm install, issues an HTTPS GET to the hardcoded endpoint...
Malicious code in dxrs-dos (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1634fc433b5cd1e5e4baa139e8795b6b6ef51bb80fdbdc5183fb7fed419aee33 Package is an openly-advertised DDoS/booter toolkit L4/L7 flood methods, SSH brute force, C2 panel builder with keywords such as "ddos attack script"...
Malicious code in dxr-dos (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bad9a4bf59f5c59d899f7be2c655adaba56f8ce65f284519d9778ea1bcaff1f bin/dxr.js unconditionally requires the external npm package 'deathoffather-project' pinned to the mutable 'latest' tag and immediately invokes an...
Malicious code in hardhat-hold (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e961a4e9f774d02e73039b143503a3fff7cad6fdbf164123d76a3d5de53c667e The package's main entry index.js unconditionally requires./lib/config, which is a 4MB obfuscator.io-style blob string array of 23,981 entries with a...
Malicious code in config-helper-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1033a9895c7d1a1b4d2c3f671caa239bd40f3985ab71d096fd25fbb7c977ef71 [email protected] exposes a default function getPlugin that issues an HTTPS request to a hardcoded bare-IP host...
Malicious code in animate-css-vite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d6c86a03c6106e799d0817676fcc92f022b64790aab209aa9fe663c085c4e6 plugin.js contains an RC4/base64 string-array obfuscated function invoked from the exported createPlugin factory. When a consumer's build instantiate...
Malicious code in ambera (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d24544221570c21c3b710d7c4d39ed76e7cc8b43a555bb7c8e6fefa78aa3f625 The package presents itself as a zero-dependency SVG helper, but its exported getPlugin function performs an HTTPS GET to the hardcoded host...
Malicious code in ai-texts (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f70364834c6aa09fed4520d6144867e921c75f416d315addf2ec3b28a92d2e4 The package advertises itself as text helpers for AI pipelines toText/normalizeText but src/index.js unconditionally invokes a dropper at module top...
MAL-2026-14216 Malicious code in timed-assess (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d39931b57405563b5114ee92146f85eeeddbeb0e235dae9f483c2b30764f47e package.json declares postinstall: node apps, which loads apps/index.js. The script reads a bundled file, decrypts it with hardcoded DES key...
