Malicious code in latam-xp-analytics-plugin-gtm (npm)

Source: ossf-package-analysis 333a48f2dfbcb9ab75608fb120182771732f71543d3bc13c3352b144b3022403 The OpenSSF Package Analysis project identified 'latam-xp-analytics-plugin-gtm' @ 2.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in knowpro-test (npm)

Source: ossf-package-analysis 1c8dc0e73cf498b9479d7045fd9cea3dc3db6ef7ca2ada5316282da6a97ed805 The OpenSSF Package Analysis project identified 'knowpro-test' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity....

Malicious code in kmz1 (npm)

Source: amazon-inspector 764e3cb5b5016e17afcd37b7b263ec2575af32008338ff14e72dd73b1d82bfa1 The package kmz1 was found to contain malicious code. Source: ossf-package-analysis 2a6ae2284037ed233d5af5263950214a55a620b61dde2f0b12669eced34b1957 The OpenSSF Package Analysis project identified 'kmz1' @...

Malicious code in kkkarem (npm)

Source: amazon-inspector 5221f3ec4ce8c314da6ded901d34c1ef2a0f7822bbec42d09a218885c47b41b2 The package kkkarem was found to contain malicious code. Source: ossf-package-analysis 85f2f16bc0953b5738e5248e16c823f06c7e3e9805d0e85726a59b9d72a4f30b The OpenSSF Package Analysis project identified 'kkkare...

Malicious code in keycloak-server (npm)

Source: ossf-package-analysis 3df989aa26dccceca3917c9b3454427df4f54e9c104fbc080e913d30af3e66b2 The OpenSSF Package Analysis project identified 'keycloak-server' @ 0.0.2 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in katal-platform-versions (npm)

Source: ossf-package-analysis 8dc8f21e750df73dfe46bbeba3bcfac8e88308adddf33680ce9751e7a1fec4af The OpenSSF Package Analysis project identified 'katal-platform-versions' @ 99.99.99 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in karem4 (npm)

Source: amazon-inspector 5a1d3bd676881934532a2e75fd644e22b2e4f26fb08bde6d48ff6d529de7467d The package karem4 was found to contain malicious code. Source: ossf-package-analysis b843a0d849da7453ce803b77a117a501a3b1e4b04eae8222d3b59d48438931cc The OpenSSF Package Analysis project identified 'karem4'...

Malicious code in karem7 (npm)

Source: amazon-inspector 1cdfd9c23b7a8d5b1d531b80431c97eb2b950c10d528d537fdd70ed62659d3d6 The package karem7 was found to contain malicious code. Source: ossf-package-analysis fc2e767d0dc38af90a1b88381666d2332a206a84b4d73a078ad57de5df3d7088 The OpenSSF Package Analysis project identified 'karem7'...

Malicious code in karemm2 (npm)

Source: amazon-inspector bdd5f17df1d0a4a9093ad436f4dafa59a288c2c650f7f1dff5cd36af67b5e98f The package karemm2 was found to contain malicious code. Source: ossf-package-analysis 4b8bdcb09150b560d85e5ddba2a0f76f1f26e6a330c437c93d4cd8b7560a2d28 The OpenSSF Package Analysis project identified 'karemm...

Malicious code in karemm6 (npm)

Source: amazon-inspector 7f481c97f5f745c99eb45dfa9b3744087e80ec7ac13fe1fb4043ca0274c625c3 The package karemm6 was found to contain malicious code. Source: ossf-package-analysis d17f9161b68d61aa5f69d4d313d653d03c3256893ac716347d63dade604eea0c The OpenSSF Package Analysis project identified 'karemm...

Malicious code in just-config-data (npm)

Source: ossf-package-analysis 8f014f07f8a3583cf07008dc133b2276390b17d34f6eae237b48210437247544 The OpenSSF Package Analysis project identified 'just-config-data' @ 0.0.3 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in justeat-storybook (npm)

Source: ossf-package-analysis 577d8ffd11e5da3a5000b8a390c45c8474d2dd362e509a65a107f2b0df13e563 The OpenSSF Package Analysis project identified 'justeat-storybook' @ 1.0.3 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

Malicious code in jquery-overscroll (npm)

Source: ossf-package-analysis 279b9014e86c11c82ac819b5e3bbbbbfc2868e3131b65bd941e60d08985cfbb0 The OpenSSF Package Analysis project identified 'jquery-overscroll' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

CVE-2026-92718

A flaw was found in Nuclei. An attacker can exploit a vulnerability in how Nuclei caches template signature verification. By replacing verified templates with malicious content and restoring the original modification time, an attacker can bypass signature checks, leading to the execution of...

EUVD-2026-81292

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose Yii's cookieValidationKey is derived from...

PT-2026-95071

Name of the Vulnerable Software and Affected Versions Dromara mayfly-go versions prior to 1.11.6 Description A missing authorization issue exists within the AI Assistant component, specifically in the server/internal/ai/api/ai.go file. This flaw allows for remote exploitation via a whitelist bypa...

CVE-2026-53557: Improper Neutralization of Special Elements used in an SQL Command

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

CVE-2026-47252: Improper Control of Generation of Code

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, authenticated users with INSERT or UPDATE access to affected macOS virtual tables can execute operating-system commands because the Chrome plugin and equivalent Brave, Edge, and Safari variants interpolate a SQL-controlled UR...

CVE-2026-92986: Improper Neutralization of Input During Web Page Generation

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to childprocess for command execution...

CVE-2026-92985: Improper Neutralization of Input During Web Page Generation

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to childprocess for...