Malicious code in sui-migration-audit-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc8cd463940a0fe70eee979bd85b9ea41eed627f30cf96be8e0174c9106c7e1 The package presents itself as an audit rule pack but ships a credential harvester in index.js. Its exported postScan routine copies /.sui/sui.keysto...

MAL-2026-12472 Malicious code in sui-migration-audit-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc8cd463940a0fe70eee979bd85b9ea41eed627f30cf96be8e0174c9106c7e1 The package presents itself as an audit rule pack but ships a credential harvester in index.js. Its exported postScan routine copies /.sui/sui.keysto...

Malicious code in statist-browser-typed-client-mb.product.operations (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8cd571b2f151fe07ba9e4be24c62290f79b73880ec1da77324b192a1b3af24f index.js unconditionally requires./bridge on module load. bridge.js selects an OS/arch-specific payload URL from string-array-concatenated hostnames...

MAL-2026-12448 Malicious code in statist-browser-typed-client-mb.product.operations (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8cd571b2f151fe07ba9e4be24c62290f79b73880ec1da77324b192a1b3af24f index.js unconditionally requires./bridge on module load. bridge.js selects an OS/arch-specific payload URL from string-array-concatenated hostnames...

Malicious code in streak-calendar-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2544026164712ffe31b1007b7cb23f36f8cd05134a638dedbd6e8ae3539a084 index.mjs executes on module import and, when running inside WSL gated on WSLDISTRONAME, linux platform, and NODEENV!=production, fetches a remote...

MAL-2026-12458 Malicious code in streak-calendar-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a2544026164712ffe31b1007b7cb23f36f8cd05134a638dedbd6e8ae3539a084 index.mjs executes on module import and, when running inside WSL gated on WSLDISTRONAME, linux platform, and NODEENV!=production, fetches a remote...

Malicious code in boxy-fixture-allure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef7772152485e16aab94cf983bcc5470787d75d67bb58b6f9fd8e44e1497fcbc boxy-fixture-allure ships an index.js that unconditionally requires./shim on load. shim.js reconstructs C2 hostnames via runtime string-splitting/.jo...

MAL-2026-12342 Malicious code in boxy-fixture-allure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef7772152485e16aab94cf983bcc5470787d75d67bb58b6f9fd8e44e1497fcbc boxy-fixture-allure ships an index.js that unconditionally requires./shim on load. shim.js reconstructs C2 hostnames via runtime string-splitting/.jo...

Malicious code in streak-metricsa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a707525e88d0f5d3004f833b17a7544655da43715d9d7af3e6d635ff3a6801a9 [email protected] presents itself as a calendar-day math helper but its main entry dist/index.mjs, the default exports target embeds a Linux x86-...

MAL-2026-12470 Malicious code in streak-metricsa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a707525e88d0f5d3004f833b17a7544655da43715d9d7af3e6d635ff3a6801a9 [email protected] presents itself as a calendar-day math helper but its main entry dist/index.mjs, the default exports target embeds a Linux x86-...

EUVD-2026-53351

tinyobjloader-c's tinyobjparseandindexmtlfile tinyobjloaderc.h reads each line of a .mtl material file into a fixed 4096-byte stack buffer linebuf via memcpylinebuf, p, plen, guarded only by assertplen 4095. Because assert compiles to a no-op under -DNDEBUG standard for release builds, a crafted...

EUVD-2026-53348

The LINUXTCP port of FreeModbus contains an off-by-one bounds check in xMBPortTCPPool demo/LINUXTCP/port/porttcp.c. The check if usTCPFrameBytesLeft MBTCPBUFSIZE uses a strict greater-than comparison instead of greater-than-or-equal against the 263-byte MBTCPBUFSIZE limit. An MBAP frame with a...

Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM Vulnerability Details CVEID:CVE-2024-34459 DESCRIPTION: An issue was discovered in xmllint from libxml2 before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a...

recon-arc

ReconARC 🔍 Advanced Reconnaissance & Attack-path Ranking Co...

claudit

claudit – AI-based code security auditing tool claudit is an...

CVE-2026-71249

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...

CVE-2026-71238

DjangoCRM ships with its Django SECRETKEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for session signing, CSRF token generation, and password reset tokens, anyone who reads the public repository can forge valid...

CVE-2026-12609

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path HTTP endpoint, which resolves the requested file path with path.resolvelocalPath, filePath without verifying that the resolved path stays within the plugin's...

EUVD-2026-53322

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...

CVE-2026-71249

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...