75513 matches found
Malicious code in minimalistic-assert-plus (npm)
Source: amazon-inspector e59f4af9a6f3f95bf4cf795fb91bcf4c7934dbb90e64d750255a2a786ed7dc75 The package typosquats minimalistic-assert and re-ships the Chai library alongside a malicious dispatcher. On require'minimalistic-assert-plus', index.js spawns a detached Node child spawn'node',...
Malicious code in external-process-live-log (npm)
Source: amazon-inspector e3b21f410276a5ec436e583a1b0c08aab7f5f977f3868fd742c7a05ab0197751 The package's default export issues an HTTPS request to the hardcoded bare-IP endpoint https://31.97.137.157:45000/icons/107 with a 'bearrtoken: logo' header and a font-awesome-styled path used as cover and...
Malicious code in @leonardo0902/vortex-kit (npm)
Source: amazon-inspector 1707e031a6c470479ecbd0b01a480cc801a9d049a3732abc265ccad8791272a9 The main module in @leonardo0902/[email protected] issues an HTTPS request to a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/116 and passes the returned credits field to new Function'require',...,...
Malicious code in prediction-trader (npm)
Source: amazon-inspector da26a91c3cc6d5bf4957fa3f713a63e579b820c40b57b24209df61b2a53d7e87 index.js contacts a hardcoded bare-IP endpoint at 31.97.137.157:45000/icons/108 disguised as an icon/CDN fetch variables named iconDomain/getPlugin, path /icons/, header 'bearrtoken: logo', retrieves a JSON...
Malicious code in power-assert-plus (npm)
Source: amazon-inspector ff97d4bae356db6a165ae845ee186c814f89bd1ee40e839d6da054965bfbd823 power-assert-plus is a typosquat of power-assert. On every require, index.js detach-spawns node build/power-assert-plus.js. That build file is obfuscator.io-encoded string-array + custom base64 alphabet and,...
CVE-2026-73649
creationtimestamp| type| source ---|---|--- 2026-08-13 18:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msybmctsmt2e 2026-08-13 20:35:09+00:00| published-proof-of-concept| https://github.com/shepherdwind/velocity.js/security/advisories/GHSA-7gfh-x38p-prh3...
CVE-2026-73567
creationtimestamp| type| source ---|---|--- 2026-08-13 18:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msyb2gigt42p 2026-08-13 18:35:13+00:00| published-proof-of-concept| https://github.com/JuneAndGreen/sm-crypto/security/advisories/GHSA-vh45-f885-3848...
CVE-2026-73037 Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter
Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration...
CVE-2026-73037
Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration...
CVE-2026-73037 Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter
Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration...
CVE-2026-73037
Summary: CVE-2026-73037 affects Next AI Draw.io versions 0.2.1–0.4.16. The issue is a reflected XSS vulnerability in the mcp query parameter, which is interpolated into HTML/JavaScript without proper escaping. Impact (as stated): Attackers can craft malicious URLs to execute arbitrary JavaScript ...
EUVD-2026-58196
Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration...
CVE-2026-73647
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the public extend utility in ui/src/utils/extend/extend.js recursively copied attacker-controlled object keys during extendtrue, target, source deep merges without rejecting an own proto propert...
CVE-2026-73569
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...
CVE-2026-73643
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load or loadAll on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a...
UBUNTU-CVE-2026-73569
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities...
UBUNTU-CVE-2026-73643
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load or loadAll on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a...
EUVD-2026-58193
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because...
CVE-2026-73650 SVGO: removeScripts plugin leaves some executable scripts intact
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because...
CVE-2026-73650
SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 1.0.0 until versions 2.8.3, 3.3.4, and 4.0.2, the removeScripts plugin, named removeScriptElement in versions 1 through 3, can leave executable content in optimized SVGs because...