PT-2026-85076

A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authenticated user able to modify dashboard widg...

PT-2026-84980

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A stored Cross-Site Scripting XSS issue exists in the notification template functionality. An administrator can input malicious HTML content via the endpoint...

Malicious code in baryon-perturbation-javascript-pyxis (npm)

Source: amazon-inspector 82e3b91264dd6978584ccce3d20c13f45009b8478f3c69fb0ec077a6d48a37fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in axios-javascript-miranda-zenith (npm)

Source: amazon-inspector 0f51a91843912d9a042988b80cf5c9feb3a9a0654f7bfcf8ac595a001837f93a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in aws-encryption-sdk-javascript (npm)

Source: ossf-package-analysis ded7612b942b1e3da52d4dfc7abcb64d6ad4bd30d80fac04815238838f9f4763 The OpenSSF Package Analysis project identified 'aws-encryption-sdk-javascript' @ 23.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in avx-javascript-testing (npm)

--- Credit: OpenSSF source...

Malicious code in async-mutex-v3 (npm)

Source: amazon-inspector 699abe52cb380ae997f200e0615bfce84cd52d11b98a54244ce5b30478fab336 Package name typosquats async-mutex but ships unrelated functionality. The default export getPlugin in index.js issues an HTTP request to a hardcoded bare IP endpoint http://46.183.25.232:45000/icons/108 and...

Malicious code in async-mutex-hook (npm)

Source: amazon-inspector 624c93cbd007656467757c5504db29971b220bc36685eda2af6a1d1390715133 Package is published under the name async-mutex-hook and self-describes as a Promise-based mutex library, but ships no mutex implementation. Its exported getPlugin function issues an HTTPS request to the...

CVE-2026-84665

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permissi...

CVE-2026-84649

In Stapler 1839.ved17667baeb5 through 2107.v8dfcbe8ed317 both inclusive, except 2088.2093.vd7c3e58008a6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

CVE-2026-78222

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

AZL-99300 CVE-2026-78222 affecting package nginx for versions less than 1.30.4-1

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

DEBIAN-CVE-2026-78222

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

CVE-2026-78222

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

CVE-2026-18329

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...

UBUNTU-CVE-2026-18329

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...

UBUNTU-CVE-2026-78222

A vulnerability exists in NGINX JavaScript where a malformed HTTP response received by ngx.fetch can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response. Impact: This vulnerability may allow remote...

CVE-2026-78689

Description NGINX JavaScript njs has a vulnerability in the XML module's namespace prefix list parser, reachable through the xml.exclusiveC14n method. An unauthenticated remote attacker can trigger it when an affected NGINX configuration passes an externally controlled XML namespace prefix list t...

CVE-2026-84673

Jenkins Customizable Header Plugin 295.v2544bca19b97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting XSS vulnerability...

EUVD-2026-70146

Jenkins Customizable Header Plugin 295.v2544bca19b97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting XSS vulnerability...