CVE-2025-58653

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JS Morisset JSM filegetcontents Shortcode wp-file-get-contents allows Stored XSS.This issue affects JSM filegetcontents Shortcode: from n/a through = 2.7.1...

CVE-2025-57353

The Runtime components of messageformat package for Node.js before 3.0.2 contain a prototype pollution vulnerability. Due to insufficient validation of nested message keys during the processing of message data, an attacker can manipulate the prototype chain of JavaScript objects by providing...

PT-2025-39317

Name of the Vulnerable Software and Affected Versions messageformat versions prior to 3.0.1 Description The Runtime components of the messageformat package for Node.js are susceptible to a prototype pollution issue. Insufficient validation of nested message keys during message data processing...

Web3.js 安全漏洞

Web3.js is a TypeScript implementation of the Ethernet JSON RPC API open-sourced by Web3 and related tools maintained by ChainSafe Systems. A security vulnerability exists in Web3.js versions 1.10.4 and earlier, which stems from prototype contamination in the attachToObject function and could lea...

Web3.js 安全漏洞

Web3.js is a TypeScript implementation of the Ethernet JSON RPC API open-sourced by Web3 and related tools maintained by ChainSafe Systems. A security vulnerability exists in Web3.js versions 1.10.4 and earlier, which stems from prototype contamination in the attachToObject function and could lea...

CVE-2025-58653

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JS Morisset JSM filegetcontents Shortcode wp-file-get-contents allows Stored XSS.This issue affects JSM filegetcontents Shortcode: from n/a through = 2.7.1...

CVE-2025-58234

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JoomSky JS Job Manager js-jobs allows Stored XSS.This issue affects JS Job Manager: from n/a through = 2.0.2...

CVE-2025-58234 WordPress JS Job Manager Plugin <= 2.0.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in JoomSky JS Job Manager js-jobs allows Stored XSS.This issue affects JS Job Manager: from n/a through = 2.0.2...

Malicious code in skiko-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 381c5141fd91ab3795d9f9dba07327b46acb9f0f3a869e49411412f5bcbe6ea2 The OpenSSF Package Analysis project identified 'skiko-js' @ 10.0.1 npm as malicious. It is considered malicious because: - The package...

MAL-2025-47462 Malicious code in skiko-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 381c5141fd91ab3795d9f9dba07327b46acb9f0f3a869e49411412f5bcbe6ea2 The OpenSSF Package Analysis project identified 'skiko-js' @ 10.0.1 npm as malicious. It is considered malicious because: - The package...

matrix-js-sdk has insufficient validation when considering a room to be upgraded by another

Impact matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated attacker-supplied room. Patches The issue has been patched and users should upgrade to...

Malicious code in @tnf-dev/js (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 292d245c3ca4d0fdd82283650bae7b8c7da1f843e984906c10402454c065daec Any computer that has this package installed or running should be considered fully compromised. All...

CVE-2025-59160 matrix-js-sdk has insufficient validation when considering a room to be upgraded by another

Matrix JavaScript SDK is a Matrix Client-Server SDK for JavaScript and TypeScript. matrix-js-sdk before 38.2.0 has insufficient validation of room predecessor links in MatrixClient::getJoinedRooms, allowing a remote attacker to attempt to replace a tombstoned room with an unrelated...

Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service [CVE-2025-5889]

Summary Node.js module brace-expansion is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability in Node.js module...

Malicious code in @crowdstrike/foundry-js (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b692cc7f6e5464ffd853e3847c9818751b07e7730ef96f968e01aea83827605f Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-47215 Malicious code in @crowdstrike/falcon-shoelace (npm)

postinstall script executes bundle.js. bundle.js triggers unsignedbitwisemathexcess YARA rule. Suspicious behavior indicates malware. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 035c35169c1f3c6c939e3237ce0bb606645b05601db61892b5d54cbeea095b57 Any computer that h...

Malicious code in cucumber-js-browserstack (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2f1891754984c705408dd02f9fb37660e1d4d84780ad4be25a83910d1eb789d Any computer that has this package installed or running should be considered...

MAL-2025-47304 Malicious code in cucumber-js-browserstack (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2f1891754984c705408dd02f9fb37660e1d4d84780ad4be25a83910d1eb789d Any computer that has this package installed or running should be considered...

Malicious Package

Overview cucumber-js-browserstack is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Embedded Malicious Code

Overview json-rules-engine-simplified is a simple rules engine expressed in JSON Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentia...