PT-2026-76894

Name of the Vulnerable Software and Affected Versions uniget CLI affected versions not specified Description A path traversal issue exists in the handling of hook filenames. The application fails to sanitize user input, allowing the direct concatenation of filenames with the hooks directory path...

PT-2026-76895

Name of the Vulnerable Software and Affected Versions Etherpad versions prior to 3.3.0 Description Stored cross-site scripting occurs when the getHTMLFromAtext function in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data...

Malicious Package

Overview ioe18n is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview ie18u is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview joxn is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector T...

Malicious Package

Overview orakw is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview ri18nr is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview ise18n is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview rakier is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview brumdler is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vect...

Malicious Package

Overview activesupmport is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attac...

Malicious Package

Overview reaker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview iai8n is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview i1l8n is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview i18om is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview ubnlder is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vecto...

Malicious Package

Overview ubnuler is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vecto...

MAL-2026-14069 Malicious code in kb-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d69143a6cdc0a652f91210034751420f7ada3db2a13d81d9e635e3a63333dc5 On import kbai, the package's init.py triggers kbai.utils.callback, which starts a background thread that collects installer host identifiers hostnam...

CVE-2026-15002

The CVE-2026-15002 entry concerns the Platnosci Online Blue Media (Autopay) WordPress plugin. A Stored XSS exists in versions up to 5.0.0 via the bm_woocommerce_css_editor_content POST parameter. The root cause is Css_Editor::handle_save() being wired to WordPress 'init' by Settings_Manager::init...

Malicious code in @openrepl/shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fcd297122e7aac00cd0d3d92fcb5f1fc00b6c558571a037b5447eb64bd443b8 package.json declares a preinstall hook node index.js that runs automatically on npm install. index.js shells out via childprocess to execute curl -X...