static-analysis

This repository lists static analysis tools for all programming languages, build tools, config files and more. The focus is on tools which improve code quality such as linters and formatters. The official website, analysis-tools.dev is based on this repository and adds rankings, user comments, an...

ysoserial

ysoserial A proof-of-concept tool for generating payloads that exploit unsafe Java object deserialization. Description Originally released as part of AppSecCali 2015 Talk "Marshalling Pickles: how deserializing objects will ruin your day" with gadget chains for Apache Commons Collections 3.x and...

Malware in @ecg-internal/aurora-js-formatters

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-18207 Malicious code in @ecg-internal/aurora-js-formatters (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02325fb617beffd55194047faca7300b33934cd471de94bab66a24954200cba0 The package uses an internal-looking scope @ecg-internal and an implausibly high version 99.0.1 consistent with dependency-confusion targeting. On...

DRUPAL-CONTRIB-2026-225

The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module. The PHP formatter engine runs eval to execute user-provided PHP code and allows arbitrary PHP execution on the site. The permissions UI gives no indication about...

PT-2026-120899

The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module. The PHP formatter engine runs eval to execute user-provided PHP code and allows arbitrary PHP execution on the site. The permissions UI gives no indication about...

Custom Formatters - Critical - Remote code execution - SA-CONTRIB-2026-225

The Custom Formatters module allows users to easily create custom Field Formatters through an admin UI without writing a custom module. The PHP formatter engine runs eval to execute user-provided PHP code and allows arbitrary PHP execution on the site. The permissions UI gives no indication about...

Astra Linux – Vulnerability in ruby-kramdown

Before version 2.3.1, Kramdown did not restrict Rouge formatters to the Rouge::Formatters namespace, allowing arbitrary classes to be instantiated...

CVE-2026-104466

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the...

CVE-2026-104466 YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the...

EUVD-2026-91477

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the...

CVE-2026-104466

YesWiki versions prior to 4.6.7 are susceptible to a stored cross-site scripting (XSS) vulnerability located in the formatters/wakka.php component. The root cause is the improper handling of quotes in markdown image URLs , which allows users with page editing or comment posting privileges to inje...

CVE-2026-104466 YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the...

CVE-2026-104466 YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the...

PT-2026-104276

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the...

CVE-2026-104466: Improper Neutralization of Input During Web Page Generation

YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or post comments to inject event handlers by placing quotes in markdown image URLs. Attackers can store a crafted markdown image whose src breaks out of the...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection in the process method of sqlparse/filters/output.py when generating output via the Python and PHP output formatters. The formatters previously only escaped quote characters ' or " but did not first escape...

CVE-2026-73156: Improper Neutralization of Input During Web Page Generation

Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationshiptype, pattern prefixes, and MISP category/type values. Since...

CVE-2026-46629

Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-controlled filter arguments such as locale, pattern, and attrs, allowing a template to allocate many ICU formatter objects that remain pinned...

CVE-2026-46629 Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments

Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-controlled filter arguments such as locale, pattern, and attrs, allowing a template to allocate many ICU formatter objects that remain pinned...