EUVD-2026-1379

Malicious code in redis-cookie-ts npm...

Malicious Package

Overview redis-cookie-ts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

SUSE CVE-2025-69230

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs...

Important: amazon-ssm-agent

Issue Overview: Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon. CVE-2025-22874 Proxy-Authorization and Proxy-Authenticate headers...

PT-2026-1676

Name of the Vulnerable Software and Affected Versions FaceSentry Access Control System version 6.4.8 Description The FaceSentry Access Control System is susceptible to a cleartext transmission issue. This allows remote attackers to intercept authentication credentials through man-in-the-middle...

Medium: curl

Issue Overview: When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect...

📄 WordPress Chained Quiz 1.3.5 Insecure Direct Object Reference

WordPress Chained Quiz plugin versions 1.3.5 and below appear to suffer from an insecure direct object reference. The issue was partially patched in versions 1.3.4 and 1.3.5. Exploit Title: Chained Quiz 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie Date: 19-12-2025 Exploit...

CVE-2025-65212

An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification, allowing an attacker to directly request the configuration file address and download the core configuration file without logging into the...

CVE-2025-65212

An issue was discovered in NJHYST HY511 POE core before 2.1 and plugins before 0.1. The vulnerability stems from the device's insufficient cookie verification, allowing an attacker to directly request the configuration file address and download the core configuration file without logging into the...

CVE-2020-36917 iDS6 DSSPro Digital Signage System 6.2 Cleartext Password Disclosure via Cookie

iDS6 DSSPro Digital Signage System 6.2 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept authentication credentials through cleartext cookie transmission. Attackers can exploit the autoSave feature to capture user passwords during man-in-the-middl...

CVE-2020-36914

CVE-2020-36914 affects QiHang Media Web Digital Signage 3.0.9. The issue is a sensitive information disclosure where authentication credentials can be intercepted because cookies are transmitted in cleartext, enabling potential MITM attackers to capture stored credentials. The sources consistentl...

EUVD-2026-1133

Malicious code in redis-cookie-js npm...

Malicious Package

Overview redis-cookie-parser is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in redis-cookie-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c702113d5f2bf54eeb40b14947991242428d0d3fe07c09560ea2c10d953975f The package redis-cookie-js was found to contain malicious code. Source: ghsa-malware b7f1f65a70f0f5ed9257e64aa9d820766513adeb5a13fc8ac7ae11b9cf58d57...

MAL-2026-66 Malicious code in redis-cookie-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c702113d5f2bf54eeb40b14947991242428d0d3fe07c09560ea2c10d953975f The package redis-cookie-js was found to contain malicious code. Source: ghsa-malware b7f1f65a70f0f5ed9257e64aa9d820766513adeb5a13fc8ac7ae11b9cf58d57...

Malicious Package

Overview redis-cookie-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2026-1132

Malicious code in redis-cookie-parser npm...

Malicious code in redis-cookie-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91375f4f82c5d4299e69cf91489e82b06358bccaa40ec51ab1c19c3e03e3e99a The package redis-cookie-parser was found to contain malicious code. Source: ghsa-malware...

MAL-2026-67 Malicious code in redis-cookie-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91375f4f82c5d4299e69cf91489e82b06358bccaa40ec51ab1c19c3e03e3e99a The package redis-cookie-parser was found to contain malicious code. Source: ghsa-malware...

DEBIAN-CVE-2025-69230

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an attacker may be able to trigger a storm of warning-level logs...