Malicious code in html-webpack-plugin-4 (npm)

--- Credit: OpenSSF source...

Malicious code in html-webpack-plugin-csrf-link-changelog (npm)

Source: amazon-inspector 922ca18a44731d301d1740519b17256d39a472601f460a03933bf194565d2642 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in html-webpack-plugin-astro-blitz-procyon (npm)

Source: amazon-inspector 6dd60d4c15ba4743a5534b1eb8ea3d9e85b07a6b0c815b5ad417301435de30ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in html-webpack-plugin-hyperion-vulcan-neptune (npm)

Source: amazon-inspector 0b341a0c15bb2ca0e6a7ae84ac4e02681230227fc30a00d3a2f1af1c0d6f4f74 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in html-webpack-plugin-dagda-axios-jest (npm)

Source: amazon-inspector fd44a0f3438ed033d971d6d6adc6c38cdca7d0c501da7a663d61e6e037ad2b0e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in html-webpack-plugin-hologram-stream-install (npm)

Source: amazon-inspector 07f786614246d2d9d6432c8d36c1015a7c75b9a2b3c99baa78f244a48ad6eb9f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in html-patcher (npm)

The package html-patcher was found to contain malicious code. --- Credit: OpenSSF source...

formii (1.0.0), html-patcher-stream (>=1.0.0, <=1.1.0) +1 more potentially affected by unknown CVE via html-patcher (>=0.0.3, <=0.1.0)

html-patcher NPM version =0.0.3, =1.0.0, =0.1.0, =1.0.0 Source cves: unknown CVE Source advisory: GHSA-87JR-3H66-8JFM...

Malicious code in helios-html-webpack-plugin-colors-achernar (npm)

Source: amazon-inspector 15ca9906844a152840e647de99226967674d883cd6fd3e8fa73c798a11b93d04 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in grus-neutrino-html-webpack-plugin-cluster (npm)

Source: amazon-inspector 79a14acd51b16527de68df05b7eba63021818a88f6afa51641dce35a4440aa5f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in gridsome-oauth-bulma-html-webpack-plugin (npm)

Source: amazon-inspector f07451b678a3fdfbd18a8d0021a392029d22dd35b437bdc15c8d3c07a3555463 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in google-chalk-html-webpack-plugin-antares (npm)

The package google-chalk-html-webpack-plugin-antares was found to contain malicious code. --- Credit: OpenSSF source...

PT-2026-90839

Name of the Vulnerable Software and Affected Versions Amundsen frontend versions prior to 4.3.1 Description The frontend renders table, dashboard, and feature descriptions using the dangerouslySetInnerHTML property without proper HTML sanitization within the ResourceListItem components. This allo...

perl-HTML-FormHandler-0.410.2-1.1 on GA media (moderate)

perl-HTML-FormHandler-0.410.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:11745-1 Rating: moderate Cross-References: CVE-2022-4993 CVE-2026-19872 CVE-2026-85484 CVE-2026-85485 CVE-2026-85630 Affected Products: openSUSE Tumbleweed An update that solves 5 vulnerabilities can now be installed...

CVE-2026-89268

QloApps through 1.7.0 renders back-office list filter POST parameters into HTML input value attributes without escaping them in the list helper template. Attackers can induce authenticated users to submit crafted POST requests with malicious payloads to list controllers, executing arbitrary...

CVE-2026-89268

QloApps through 1.7.0 contains a reflected cross-site scripting (XSS) vulnerability in the back-office list helper template (list_header.tpl). POST parameters from list filter forms are rendered into HTML value attributes without escaping , allowing an attacker to induce an authenticated user to ...

CVE-2026-81917

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

EUVD-2026-76689

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

CVE-2026-81917 Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...

CVE-2026-81917 Concrete CMS below 9.5.3 is vulnerable to Stored XSS in the Document Library block file description and tags

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block, so a user with permission to edit file properties could store a script payload that executed in the browser of any visitor to a page displaying the block...