Malicious code in streak-daykit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c7d8d4f5dc118e83eddeb156c2687b1ef439348e3006579eae48f219488cc6b On import of the package's main entry, a top-level bootstrap IIFE in index.mjs runs a Linux-gated routine that detects a WSL environment by probing...

MAL-2026-12466 Malicious code in streak-daykit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c7d8d4f5dc118e83eddeb156c2687b1ef439348e3006579eae48f219488cc6b On import of the package's main entry, a top-level bootstrap IIFE in index.mjs runs a Linux-gated routine that detects a WSL environment by probing...

Malicious code in calendar-streak-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d34b4caa6716625380bd2636072e5fe0473d114ab3fdfd8335f9e1c0e642ddc4 [email protected] is advertised as a dependency-free calendar-day and streak math library, but index.mjs embeds a hex-encoded Windows PE...

MAL-2026-12345 Malicious code in calendar-streak-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d34b4caa6716625380bd2636072e5fe0473d114ab3fdfd8335f9e1c0e642ddc4 [email protected] is advertised as a dependency-free calendar-day and streak math library, but index.mjs embeds a hex-encoded Windows PE...

Malicious code in dolyame-boxy-atom-bnpl-store-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b82cb3b1e0ca7de56472ae3d263144d8131faf53d64761943decb8937fd5bc6a On require, index.js loads loader.js, which downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at runtime...

MAL-2026-12364 Malicious code in dolyame-boxy-atom-bnpl-store-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b82cb3b1e0ca7de56472ae3d263144d8131faf53d64761943decb8937fd5bc6a On require, index.js loads loader.js, which downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at runtime...

MAL-2026-12440 Malicious code in sme-rko-finance-front-shared-entity-groups-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bde65379e0d7952a0fbdcfc1efe45f1cd08f4752ae4a15f12e5fd0d995a7d12 index.js unconditionally requires./polyfill.js on load. polyfill.js constructs C2 hostnames at runtime via Array.join to evade static inspection...

Malicious code in sme-rko-finance-front-shared-entity-groups-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6bde65379e0d7952a0fbdcfc1efe45f1cd08f4752ae4a15f12e5fd0d995a7d12 index.js unconditionally requires./polyfill.js on load. polyfill.js constructs C2 hostnames at runtime via Array.join to evade static inspection...

CVE-2026-66748-Camaleon-CMS---Authenticated-RCE-via-select_eval-Custom-Field — Updated!

Security Advisory: Camaleon CMS - Authenticated RCE via selecteval Custom Field Assigned CVE ID: CVE-2026-66748 Product: Camaleon CMS https://github.com/owen2345/camaleon-cms Affected versions: 2.1.1 – 2.9.1 introduced commit 415cbda6 2015-10-16; fixed commit 15882366 2026-03-29 / v2.9.2 Severity...

vlc:vlc-demux-dec-libfuzzer-ty: Heap-buffer-overflow in check_sync_pes

Project: https://github.com/videolan/vlc.git Detailed Report: https://oss-fuzz.com/testcase?key=6354530425176064 Project: vlc Fuzzing Engine: libFuzzer Fuzz Target: vlc-demux-dec-libfuzzer-ty Job Type: libfuzzerasanvlc Platform Id: linux Crash Type: Heap-buffer-overflow READ 16 Crash Address:...

CVE-2026-71247

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path...

EUVD-2026-53320

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. The handler upserts a...

CVE-2026-71247

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. The handler upserts a...

CVE-2026-71247 Documenso - Assistant Recipient Can Forge Another Signer's Signature in Sequential-Signing Documents

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path...

CVE-2026-71247 Documenso - Assistant Recipient Can Forge Another Signer's Signature in Sequential-Signing Documents

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path...

CVE-2026-71247

Documenso CVE-2026-71247 affects the sign-field-with-token.ts path used by the live document-signing UI. A recipient with the ASSISTANT role can fetch and complete fields for any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. The handler up...

CVE-2026-71247 Documenso - Assistant Recipient Can Forge Another Signer's Signature in Sequential-Signing Documents

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path...

llvm:llvm-isel-fuzzer--arm-O2: Use-of-uninitialized-value in createSlotTracker

Detailed Report: https://oss-fuzz.com/testcase?key=6013369242157056 Project: llvm Fuzzing Engine: libFuzzer Fuzz Target: llvm-isel-fuzzer--arm-O2 Job Type: libfuzzermsanllvm Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: createSlotTracker...

MAL-2026-12213 Malicious code in statist-browser-typed-client-mb.product.sme.cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70a2f91acb1c71608716269413dca908b94c890cd76146a377bb945a4b7e271c On require of this package, index.js loads ext.js which downloads a platform-specific executable from string-concatenated Cloudflare Workers hosts...

Malicious code in statist-browser-typed-client-mb.product.sme.cards (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70a2f91acb1c71608716269413dca908b94c890cd76146a377bb945a4b7e271c On require of this package, index.js loads ext.js which downloads a platform-specific executable from string-concatenated Cloudflare Workers hosts...