2090 matches found
CVE-2026-70426
The Remoting component (versions 3384.v60d89463d9e0 and earlier, excluding 3355.3357.v931d3c992987 ) included in Jenkins versions 2.575 and earlier (and LTS 2.568.1 and earlier) is vulnerable to a deserialization filter bypass. The root cause is that the JEP-200 class filter is not applied to cla...
CVE-2026-70426
In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...
CVE-2026-70426
In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...
CVE-2026-70426
In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...
EUVD-2026-53569
In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, cod...
Malicious code in bigops-products-timeline (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f972f857c08272cf44608802d91460fade21f3db145ac925f4d6bb7f00cdf9f8 On require, index.js loads vendor.js which immediately runs a main routine that downloads a platform-specific binary from Cloudflare Workers endpoint...
MAL-2026-13250 Malicious code in bigops-statements-timeline (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d10168eeae00c6455a6a5a4838aa1afc9460a1edbc287d0b6f8b4acab5eae316 On require of the package, index.js loads support.js which selects a platform-specific asset path and downloads a binary over HTTPS from a rotating...
MAL-2026-13252 Malicious code in bigops-storio (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 072daea48b555582ea01125b1a71fff5907e73bc890ec56f7b012ac38230b69e On require of bigops-storio, support.js selects a platform-specific endpoint and fetches an opaque binary over HTTPS from one of four string-split...
Malicious code in bigops-storio (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 072daea48b555582ea01125b1a71fff5907e73bc890ec56f7b012ac38230b69e On require of bigops-storio, support.js selects a platform-specific endpoint and fetches an opaque binary over HTTPS from one of four string-split...
Malicious code in bigops-storio-ngrx (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6eb386f3b0d35ecf71762d0e719f883a3e1e207a2a3a9e1f52e7729de7753ae0 On require, index.js loads./ext.js which selects a per-OS asset path and downloads a binary payload from one of three runtime-assembled Cloudflare...
Malicious code in devplatform-vite-plugin-gle (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81ba08fb4c9c52336f51b45ebe9089ba0b441f3da79529ac1c56f146d71861b6 On require, support.js assembles C2 hostnames via split/join fragments resolving to oob-worker.cf100-416.workers.dev, cf103-070.workers.dev,...
MAL-2026-13273 Malicious code in devplatform-vite-plugin-gle (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81ba08fb4c9c52336f51b45ebe9089ba0b441f3da79529ac1c56f146d71861b6 On require, support.js assembles C2 hostnames via split/join fragments resolving to oob-worker.cf100-416.workers.dev, cf103-070.workers.dev,...
Malicious code in devplatform-ui-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc Package advertised as a UI toolkit but on module load index.js requires adapter.js fetches an opaque platform-specific binary from obfuscated...
MAL-2026-13269 Malicious code in devplatform-ui-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 970907ab2c29512b4a538983a065bc1bfee670c15e663d00cd0b3eb751d8dbdc Package advertised as a UI toolkit but on module load index.js requires adapter.js fetches an opaque platform-specific binary from obfuscated...
MAL-2026-13282 Malicious code in dolyame-boxy-atom-bnpl-badge (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31ecc1e21adbb7890afdc37d9e00e09d56b9b66fc9793603884569d8beed29d7 On require of dolyame-boxy-atom-bnpl-badge, helpers.js fetches an OS-specific native binary from hardcoded Cloudflare Workers mirrors...
Malicious code in dolyame-boxy-atom-bnpl-dangerously-html (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48ce2aa10d245536ed6cfd1903fe1b553eef84d8e949b0bd1b970817b7f13e98 On require of the package, index.js loads loader.js which reconstructs attacker-controlled hostnames via string-split.join'' to evade scanners mirror...
MAL-2026-13285 Malicious code in dolyame-boxy-atom-bnpl-dangerously-html (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48ce2aa10d245536ed6cfd1903fe1b553eef84d8e949b0bd1b970817b7f13e98 On require of the package, index.js loads loader.js which reconstructs attacker-controlled hostnames via string-split.join'' to evade scanners mirror...
MAL-2026-13287 Malicious code in dolyame-boxy-atom-bnpl-image-card (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 484dee0934d765de93fad820114619db6ba613ac0eae09b9b402949f116e796f The package's main entry loads setup.js, which on require fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are...
Malicious code in dolyame-boxy-atom-bnpl-image-card (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 484dee0934d765de93fad820114619db6ba613ac0eae09b9b402949f116e796f The package's main entry loads setup.js, which on require fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are...
MAL-2026-13295 Malicious code in dolyame-boxy-atom-desktop-bnpl-highlighted-text (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 539999c456d5c8a3f5e2028b9bd7a0f8ca3ab41af3c67044ef7735e0c9f76845 On require, polyfill.js selects a platform-specific payload, fetches an executable from one of three Cloudflare Workers hosts whose names are assembl...