Malicious code in css-txedrf-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d70c660ff3138360df0239fc6ef3db7beaca61ca069bc2d108ed893c68acb63 thunderboltRegistry.js executes an IIFE at require time that runs OS reconnaissance commands id, whoami, uname -a, ifconfig/ip addr, cat /etc/hosts v...

MAL-2026-17558 Malicious code in css-txedrf-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d70c660ff3138360df0239fc6ef3db7beaca61ca069bc2d108ed893c68acb63 thunderboltRegistry.js executes an IIFE at require time that runs OS reconnaissance commands id, whoami, uname -a, ifconfig/ip addr, cat /etc/hosts v...

Malicious code in css-gvqmfn-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffb3f332a818748252e49dcf21ffb6949c531afd401ee697cc08ba00a067ae30 css-gvqmfn-polyfill mimics Wix internal @wix/thunderbolt- CSS polyfill naming and ships a Proxy-based cover stub that re-exports registry names...

Malicious code in css-ayucyz-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8c7540d3981f510255434529f76a2ed9a24b0783e7e8e3369b41f71b93ebd1a On require, thunderboltRegistry.js runs an IIFE that acquires childprocess via multiple fallbacks and executes shell commands id, whoami, uname -a,...

MAL-2026-17548 Malicious code in css-ayucyz-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8c7540d3981f510255434529f76a2ed9a24b0783e7e8e3369b41f71b93ebd1a On require, thunderboltRegistry.js runs an IIFE that acquires childprocess via multiple fallbacks and executes shell commands id, whoami, uname -a,...

Malicious code in css-display-reading-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b397798b7209f1094c33dc3ed721d4a3ef0536065317bd06bae76e33dd505334 The package ships payload.bundle.min.js, which on load runs an IIFE that invokes childprocess.execSync to run id, whoami, and uname, collects...

Malicious code in tostpro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b31f6e946441400814984e1285717f9b2ee7fe5dacb7f0433f89396648a6183 The npm package [email protected] ships a preinstall lifecycle hook that invokes test.sh, which runs automatically on npm install. The script assembles...

Malicious code in @inpeek/odata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dad085b4b3e089d6a6d4e6812c66a8b45f10d40bc4ab39ea7bd0ce850d17ed4b @inpeek/[email protected] is a dependency-confusion placeholder published to the public npm registry on the unregistered @inpeek scope with an inflated...

MAL-2026-17542 Malicious code in @inpeek/odata (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dad085b4b3e089d6a6d4e6812c66a8b45f10d40bc4ab39ea7bd0ce850d17ed4b @inpeek/[email protected] is a dependency-confusion placeholder published to the public npm registry on the unregistered @inpeek scope with an inflated...

CVE-2026-105179

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/adduser.php of the component Password Handler. Executing a manipulation of the argument Password can lead to missing encryption of sensitive data. It is possible to...

cve-2026-34474-zte-h298a-h108n-sensitive-data-exposure

CVE-2026-34474: Fuga de secreto en ZTE H298A / H108N a través de ETHCheat Desglose técnico de CVE-2026-34474, donde una solicitud no autenticada ETHCheat=1 provoca que los routers ZTE ZXHN H298A 1.1 y H108N 2.6 afectados devuelvan la contraseña de administrador activa, el ESSID y la PSK de WLAN e...

CVE-2026-105292 Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback

Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...

EUVD-2026-92156

Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...

CVE-2026-105292

The software Chaterm before version 0.12.1 is vulnerable to a login cross-site request forgery (CSRF) . The root cause is a lack of OAuth state validation when processing chaterm:// callbacks. A remote attacker can trigger a crafted callback from a web page to inject attacker-controlled userInfo....

CVE-2026-105292 Chaterm before 0.12.1 Login CSRF via chaterm:// OAuth Callback

Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sending chaterm:// callbacks without OAuth state validation. Attackers can trigger a crafted callback with attacker-controlled userInfo from a web page, signing th...

EUVD-2026-92470

WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array function in app/Module/Base.php, which executes eval"$array = $data;" whenever the decoded string starts...

ROS-20261005-73-0133

The vulnerability of the kawethprobe function in the drivers/net/usb/kaweth.c module of the Linux USB network adapter driver framework is related to improper validation of consistency checks in input data. Exploiting this vulnerability could allow an attacker to cause service failures...

PT-2026-106193

Deserialization of Untrusted Data vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Object Injection.This issue affects Sunshine Photo Cart: from n/a through 3.7.1...

Cross-Lingual Transferability of Training Data Extraction Attacks to Recover Memorized PII

The robustness of Personally Identifiable Information PII protection in Large Language Models LLMs is a critical concern, yet the risks associated with cross-lingual data extraction remain under-explored. This study evaluates the vulnerability of English-centric and multilingual models to Trainin...

CVE-2026-88393

WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-decoded and passed directly into the string2array function in app/Module/Base.php, which executes eval"$array = $data;" whenever the decoded string starts...