MAL-2026-13359 Malicious code in test-dev-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44b80ff2bcf35e5c92c1c8a551b943d334f94793d693ce846707986613db8108 src/config.js hardcodes a remote host as the English-word phrase "Four Five P Nine Five P One Eight Six P Two Three Seven" and decodes it at import...

admindjango-ckeditor-blog (0.1.0), django-api-commons (>=1.0.0, <=1.0.2) +1 more potentially affected by CVE-2026-15830 via django (1.11.2)

django PYPI version 1.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - admindjango-ckeditor-blog 0.1.0 - django-api-commons =1.0.0, =0.1.0, =0.3.0 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...

admindjango-ckeditor-blog (0.1.0), django-api-commons (>=1.0.0, <=1.0.2) +1 more potentially affected by CVE-2026-15307 via django (1.11.2)

django PYPI version 1.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - admindjango-ckeditor-blog 0.1.0 - django-api-commons =1.0.0, =0.1.0, =0.3.0 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

admindjango-ckeditor-blog (0.1.0), django-api-commons (>=1.0.0, <=1.0.2) +1 more potentially affected by CVE-2026-48588 via django (1.11.2)

django PYPI version 1.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - admindjango-ckeditor-blog 0.1.0 - django-api-commons =1.0.0, =0.1.0, =0.3.0 Source cves: CVE-2026-48588 Source advisory: OSV:GHSA-3H9F-R86X-QVJX...

arches (>=7.5.0a0, <=7.5.0a1), dfv (>=0.9.0, <=0.13.0) +9 more potentially affected by CVE-2026-53877 via django (4.2.4)

django PYPI version 4.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - arches =7.5.0a0, =0.9.0, =0.11.0, =2.0.0rc30, =1.0.0, =0.0.1, =0.71.0, =1.0.0, =32.5.2, =32.6.0 Source cves: CVE-2026-53877 Source advisory:...

admindjango-ckeditor-blog (0.1.0), django-api-commons (>=1.0.0, <=1.0.2) +1 more potentially affected by CVE-2024-45231 via django (1.11.2)

django PYPI version 1.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - admindjango-ckeditor-blog 0.1.0 - django-api-commons =1.0.0, =0.1.0, =0.3.0 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

geonode (>=4.1.0, <=4.2.5), grooveshop-django-api (>=0.6.0, <=0.63.0) +1 more potentially affected by CVE-2024-38356 via django-tinymce (3.6.1)

django-tinymce PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - geonode =4.1.0, =0.6.0, =0.63.0 - repomaker 1.0.0b1 Source cves: CVE-2024-38356 Source advisory: OSV:PYSEC-2026-1301...

geonode (>=4.1.0, <=4.2.5), grooveshop-django-api (>=0.6.0, <=0.63.0) +1 more potentially affected by CVE-2024-38357 via django-tinymce (3.6.1)

django-tinymce PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - geonode =4.1.0, =0.6.0, =0.63.0 - repomaker 1.0.0b1 Source cves: CVE-2024-38357 Source advisory: OSV:PYSEC-2026-1302...

grooveshop-django-api (>=0.94.0, <=0.127.0) potentially affected by CVE-2024-38356 via django-tinymce (4.0.0)

django-tinymce PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - grooveshop-django-api =0.94.0, =0.127.0 Source cves: CVE-2024-38356 Source advisory: OSV:PYSEC-2026-1301...

grooveshop-django-api (>=0.94.0, <=0.127.0) potentially affected by CVE-2024-38357 via django-tinymce (4.0.0)

django-tinymce PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - grooveshop-django-api =0.94.0, =0.127.0 Source cves: CVE-2024-38357 Source advisory: OSV:PYSEC-2026-1302...

bpp-iplweb (>=202304.1100.0, <=202504.1174.0), django-user-notification (>=0.8.0, <=0.10.2) +2 more potentially affected by CVE-2024-38356 via django-tinymce (3.7.1)

django-tinymce PYPI version 3.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - bpp-iplweb =202304.1100.0, =0.8.0, =4.3.0, =0.64.0, =0.93.1 Source cves: CVE-2024-38356 Source advisory: OSV:PYSEC-2026-1301...

bpp-iplweb (>=202304.1100.0, <=202504.1174.0), django-user-notification (>=0.8.0, <=0.10.2) +2 more potentially affected by CVE-2024-38357 via django-tinymce (3.7.1)

django-tinymce PYPI version 3.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-tinymce and may be impacted: - bpp-iplweb =202304.1100.0, =0.8.0, =4.3.0, =0.64.0, =0.93.1 Source cves: CVE-2024-38357 Source advisory: OSV:PYSEC-2026-1302...

admindjango-ckeditor-blog (0.1.0), django-api-commons (>=1.0.0, <=1.0.2) +1 more potentially affected by CVE-2026-8404 via django (1.11.2)

django PYPI version 1.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - admindjango-ckeditor-blog 0.1.0 - django-api-commons =1.0.0, =0.1.0, =0.3.0 Source cves: CVE-2026-8404 Source advisory: OSV:GHSA-8CJM-8MP7-R2XF...

CVE-2026-34406 APTRS: Privilege Escalation via Mass Assignment of is_superuser in User Edit Endpoint

APTRS Automated Penetration Testing Reporting System is a Python and Django-based automated reporting tool designed for penetration testers and security organizations. Prior to version 2.0.1, the edituser endpoint POST /api/auth/edituser/ allows Any user who can reach that endpoint and submit...

grooveshop-django-api (>=0.13.0, <=0.20.0) potentially affected by CVE-2026-27982 via django-allauth (0.55.0)

django-allauth PYPI version 0.55.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - grooveshop-django-api =0.13.0, =0.20.0 Source cves: CVE-2026-27982 Source advisory: OSV:GHSA-2JPR-83RG-V67J...

grooveshop-django-api (>=0.21.0, <=0.23.0) potentially affected by CVE-2026-27982 via django-allauth (0.55.2)

django-allauth PYPI version 0.55.2 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - grooveshop-django-api =0.21.0, =0.23.0 Source cves: CVE-2026-27982 Source advisory: OSV:GHSA-2JPR-83RG-V67J...

dj-rest-auth-mfa (>=0.0.2, <=0.0.3), dj-rest-auth-saml (>=0.0.1, <=0.0.5) +1 more potentially affected by CVE-2026-27982 via django-allauth (0.57.0)

django-allauth PYPI version 0.57.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - dj-rest-auth-mfa =0.0.2, =0.0.1, =0.28.0, =0.35.0 Source cves: CVE-2026-27982 Source advisory: OSV:GHSA-2JPR-83RG-V67J...

grooveshop-django-api (>=0.36.0, <=0.37.4) potentially affected by CVE-2026-27982 via django-allauth (0.58.0)

django-allauth PYPI version 0.58.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - grooveshop-django-api =0.36.0, =0.37.4 Source cves: CVE-2026-27982 Source advisory: OSV:GHSA-2JPR-83RG-V67J...

grooveshop-django-api (>=0.38.0, <=0.40.2) potentially affected by CVE-2026-27982 via django-allauth (0.58.1)

django-allauth PYPI version 0.58.1 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - grooveshop-django-api =0.38.0, =0.40.2 Source cves: CVE-2026-27982 Source advisory: OSV:GHSA-2JPR-83RG-V67J...

grooveshop-django-api (>=0.55.0, <=0.60.0) potentially affected by CVE-2026-27982 via django-allauth (0.59.0)

django-allauth PYPI version 0.59.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-allauth and may be impacted: - grooveshop-django-api =0.55.0, =0.60.0 Source cves: CVE-2026-27982 Source advisory: OSV:GHSA-2JPR-83RG-V67J...