135429 matches found
MAL-2026-13260 Malicious code in devplatform-spa-plugin-s3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ca84ec076b60ced1412d45476eb90fb5c797b8dd53a5151d474dc979a085565 [email protected] is a binary dropper. index.js unconditionally requires shim.js, whose top-level init fetches a platform-specific...
Malicious code in bnpl-blocks-atom-bnpl-store-button-set (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 426cd2089d6b37d7f388aae2bafb56979692557475a20302f29ccd8bb00a064e On require of the package, index.js loads support.js which downloads a platform-specific binary from string-split-obfuscated Cloudflare Workers hosts...
MAL-2026-12897 Malicious code in bnpl-blocks-atom-bnpl-store-button-set (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 426cd2089d6b37d7f388aae2bafb56979692557475a20302f29ccd8bb00a064e On require of the package, index.js loads support.js which downloads a platform-specific binary from string-split-obfuscated Cloudflare Workers hosts...
Malicious code in bnpl-blocks-independent-bnpl-origination (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7441b8e4b9daaaa54b9963006ffa7868dc6f2d7ffaa65b4c11a029c43240dde1 On require of the package's main entry, runtime.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at...
MAL-2026-12964 Malicious code in bnpl-blocks-independent-bnpl-origination (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7441b8e4b9daaaa54b9963006ffa7868dc6f2d7ffaa65b4c11a029c43240dde1 On require of the package's main entry, runtime.js downloads a platform-specific binary from Cloudflare Workers hosts whose names are reassembled at...
Cross-site Scripting (XSS)
Overview ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting XSS via the selectedRevision path in the post history modal and feature image caption rendering code. An attacker can execute script in another staff user’s Admin session by creating o...
cvelistV5 cve_2026-08-05_1300Z
Note 2026-2-17 Adding Additional day of processing for date normalization to addreess potential inconsistencies New Date Normalization schedule: 2/16/26 - 2/28/26 Note 2026-2-10 Record Date NormalizationdeltaLog.json file change The deltaLog.json file normally retains a rolling 30 days worth of C...
EUVD-2026-53389
Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...
CVE-2026-39923 Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset
Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...
CVE-2026-39923 Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset
Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...
CVE-2026-39923 Flarum < 1.8.16 Password Reset Token Expiry Bypass via POST /reset
Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...
CVE-2026-39923
Flarum before 1.8.16 contains a password reset token expiry bypass vulnerability that allows unauthenticated attackers to reuse expired password reset tokens by submitting them directly to the reset processing endpoint. The SavePasswordController::handle method calls PasswordToken::findOrFail...
CVE-2026-39923
CVE-2026-39923 affects Flarum prior to 1.8.16. A password reset token expiry bypass allows unauthenticated attackers to reuse expired tokens by POSTing to the reset endpoint; SavePasswordController::handle() calls PasswordToken::findOrFail() without expiry validation, bypassing the 24-hour token ...
MAL-2026-12557 Malicious code in checkout-desktop-legal (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e7a07623c75a85bada6117a7a71f40d19924be192a769534e544ffe31f036b0 On require of checkout-desktop-legal, index.js loads compat.js, which selects a platform-specific asset path and downloads a binary from Cloudflare...
Malicious code in checkout-desktop-legal (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e7a07623c75a85bada6117a7a71f40d19924be192a769534e544ffe31f036b0 On require of checkout-desktop-legal, index.js loads compat.js, which selects a platform-specific asset path and downloads a binary from Cloudflare...
MAL-2026-12653 Malicious code in cobrowsing-decorators (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdc5e76564b50cf17ba170a2f1da7cae4ab386277b4a03e64e79ec34e1276588 On require/import, index.js unconditionally loads bootstrap.js, which selects a platform-specific asset path, fetches an opaque binary from...
Malicious code in cobrowsing-decorators (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdc5e76564b50cf17ba170a2f1da7cae4ab386277b4a03e64e79ec34e1276588 On require/import, index.js unconditionally loads bootstrap.js, which selects a platform-specific asset path, fetches an opaque binary from...
IOSSecuritySuite v2.3.0
⭐️ Do you want to become a certified iOS Application Security Engineer? ⭐️ Check out our practical & fully online course at: https://courses.securing.pl/courses/iase ISS Description by @r3ggi 🌏 iOS Security Suite is an advanced and easy-to-use platform security & anti-tampering library written in...
Malicious code in strath (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9ae02b92920c1e028b5785e69013ea4662e4eb3180872531d64ccca00eef239 The package declares a postinstall script that runs dist/config.js. That script fetches JSON from https://my-api.trade-api.workers.dev?id=2 and then...
MAL-2026-12805 Malicious code in strath (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9ae02b92920c1e028b5785e69013ea4662e4eb3180872531d64ccca00eef239 The package declares a postinstall script that runs dist/config.js. That script fetches JSON from https://my-api.trade-api.workers.dev?id=2 and then...