Malicious Package

Overview tinkoff-statist-browser-typed-client-itsa.candy.selfservicesupport.frontend.events is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, ther...

CVE-2026-70609

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, the mode option of webContents.openDevTools was not sanitized before use by the DevTools frontend. If an attacker can influence this value,...

cloud.piranha.dist:piranha-dist-micro (>=24.11.0, <=25.6.0), cloud.piranha.extension:piranha-extension-micro (>=24.11.0, <=25.6.0) +68 more potentially affected by CVE-2026-46581 via org.glassfish:jakarta.faces (>=4.0.23, <=4.1.12)

org.glassfish:jakarta.faces MAVEN version =4.0.23, =24.11.0, =24.11.0, =24.11.0, =24.11.0, =25.1.0, =5.0.0, =5.0.0, =1.5.15, =1.5.15, =1.5.15, =11.0.0, =6.12.0, =6.12.2 - org.apache.tomee.bom:tomee-plume-api 11.0.0-m1 - org.apache.tomee:apache-tomee 11.0.0-m1 and more Source cves: CVE-2026-46581...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Doan Dinh Van in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.10...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by okndjo in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.10...

Malicious code in uploader-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 434cb8e84402c02f52788e51215db45b8c7f2f229d56c51d8302993b782cf911 The package's scripts.install runs node index.js, which loads ./lib/core and, on npm install, collects the installer's OS username via...

MAL-2026-12491 Malicious code in uploader-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 434cb8e84402c02f52788e51215db45b8c7f2f229d56c51d8302993b782cf911 The package's scripts.install runs node index.js, which loads ./lib/core and, on npm install, collects the installer's OS username via...

Malicious code in uploader-frontend-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e90aa99bc8b8e4bb886e911c1fe5ffbddd1d7e730088105118db47170b66681 The package's scripts.install runs node index.js, which loads lib/core.js and issues a dns.resolve4 query against a subdomain of oob.sl4x0.xyz...

MAL-2026-12492 Malicious code in uploader-frontend-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e90aa99bc8b8e4bb886e911c1fe5ffbddd1d7e730088105118db47170b66681 The package's scripts.install runs node index.js, which loads lib/core.js and issues a dns.resolve4 query against a subdomain of oob.sl4x0.xyz...

WordPress Frontend Admin by DynamiApps plugin < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/Deletion vulnerability

Subscriber+ Taxonomy Term Creation/Modification/Deletion vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Frontend Admin by DynamiApps versions 3.29.7...

autoreduce-frontend (>=22.0.0.dev12, <=22.0.0.dev13), djangodjangodjango (4.0.1) +4 more potentially affected by CVE-2026-15307 via django (4.0.1)

django PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - autoreduce-frontend =22.0.0.dev12, =0.0.3, =1.2.1 - railguns 0.53.0 - shaarpy 0.3.0 - vuln-repo 0.0.4 Source cves: CVE-2026-15307 Source advisory:...

autoreduce-db (>=0.1.0, <=22.0.0.dev1), autoreduce-frontend (>=21.1.1, <=21.1.3) +4 more potentially affected by CVE-2026-15307 via django (3.2.2)

django PYPI version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - autoreduce-db =0.1.0, =21.1.1, =21.1.0, =22.0.0.dev0, =21.1.2, =21.1.4 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

autoreduce-db (22.0.0.dev37), autoreduce-frontend (22.0.0.dev24) +6 more potentially affected by CVE-2026-15307 via django (4.0.6)

django PYPI version 4.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - autoreduce-db 22.0.0.dev37 - autoreduce-frontend 22.0.0.dev24 - autoreduce-qp 22.0.0.dev38 - autoreduce-rest-api 22.0.0.dev23 - autoreduce-scripts...

autoreduce-frontend (>=22.0.0.dev22, <=22.0.0.dev23), django-rq-scheduler (2022.5.1) +4 more potentially affected by CVE-2026-15307 via django (4.0.4)

django PYPI version 4.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - autoreduce-frontend =22.0.0.dev22, =0.0.17, =0.7.15, =0.7.23 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...

autoreduce-frontend (>=22.0.0.dev22, <=22.0.0.dev23), django-rq-scheduler (2022.5.1) +4 more potentially affected by CVE-2026-15830 via django (4.0.4)

django PYPI version 4.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - autoreduce-frontend =22.0.0.dev22, =0.0.17, =0.7.15, =0.7.23 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...

autoreduce-db (>=0.1.0, <=22.0.0.dev1), autoreduce-frontend (>=21.1.1, <=21.1.3) +4 more potentially affected by CVE-2026-15830 via django (3.2.2)

django PYPI version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - autoreduce-db =0.1.0, =21.1.1, =21.1.0, =22.0.0.dev0, =21.1.2, =21.1.4 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...

autoreduce-frontend (>=22.0.0.dev22, <=22.0.0.dev23), django-rq-scheduler (2022.5.1) +4 more potentially affected by CVE-2026-15830 via django (4.0.4)

django PYPI version 4.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - autoreduce-frontend =22.0.0.dev22, =0.0.17, =0.7.15, =0.7.23 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...

autoreduce-frontend (>=22.0.0.dev12, <=22.0.0.dev13), djangodjangodjango (4.0.1) +4 more potentially affected by CVE-2026-15830 via django (4.0.1)

django PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - autoreduce-frontend =22.0.0.dev12, =0.0.3, =1.2.1 - railguns 0.53.0 - shaarpy 0.3.0 - vuln-repo 0.0.4 Source cves: CVE-2026-15830 Source advisory:...

Argos — Updated!

Argos — Blockchain Asset Tracing Platform Argos is a multi-language blockchain investigation platform for tracing, analyzing, and visualizing fund flows on Ethereum and Bitcoin. Built with Rust, OCaml, and TypeScript/React. Architecture root@kitploit: +-----------------------+ | Frontend React 19...

MAL-2026-11976 Malicious code in native-frontend-orb (npm)

npm/native-frontend-orb is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...