Malicious code in wix-ssr-thunderbolt-grid-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6e0013701f6ab53085883b09092f0cd5ae9aaaab51a9f0e9de5aa68946ae9e1 The package ships two minified bundles — dist/poc-model.bundle.min.js and dist/poc-bootstrap.bundle.min.js — that are wired as the model and bootstra...

Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...

Totaljs <3.2.3 - Local File Inclusion

Total.js Platform before 3.2.3 is vulnerable to local file inclusion. id: CVE-2019-8903 info: name: Totaljs 3.2.3 - Local File Inclusion author: madrobot severity: high description: Total.js Platform before 3.2.3 is vulnerable to local file inclusion. impact: | An attacker can exploit this...

TCL-xss-Labs

XSS Lab — 赛博账簿 💸 如果这个项目对你有帮助，可以考虑捐赠10美元支持它发展。链接：https://rzp.io/rzp/zgkC6h5B 一个交互式、自托管的 XSS 训练平台 ，包含 33 个逐步升级的挑战 —— 专为黑客、渗透测试人员和开发者设计，让你从基础到真实世界利用全面掌握跨站脚本攻击。 ⚡ 为攻击者打造 ⚡ 为学习设计 ⚡ 为简洁构建 单 Node.js 服务器 无需数据库 无需构建步骤 完全 Docker 化，一键部署 挑战 33 个逐步升级的 XSS 挑战，从基础反射型到高级真实世界利用。 🟢 简单 | 名称| 描述 ---|---|--- 1| 你好，反射...

PT-2026-108145

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions 3.3.0 through 3.5.3 Description A denial of service issue exists in the zero-configuration TLS fingerprint-validation path. When the connector validates a server's identity via...

PT-2026-108147

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions 3.2.0 through 3.2.4 MariaDB Connector/Node.js versions 3.3.x prior to 3.3.4 MariaDB Connector/Node.js versions 3.4.x prior to 3.4.7 MariaDB Connector/Node.js versions 3.5.x prior to 3.5.4 Description When the...

PT-2026-108146

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.5 MariaDB Connector/Node.js versions prior to 3.3.4 MariaDB Connector/Node.js versions prior to 3.4.7 MariaDB Connector/Node.js versions prior to 3.5.4 Description When encoding GeoJSON Polygon a...

PT-2026-108148

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.5 MariaDB Connector/Node.js versions prior to 3.3.4 MariaDB Connector/Node.js versions prior to 3.4.7 MariaDB Connector/Node.js versions prior to 3.5.4 Description Text-protocol escaping fails to...

RHEL 9 : nodejs:22 (RHSA-2026:76750)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:76750 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language...

EUVD-2026-92770

Ghost: Stored XSS via File Uploads on Local Storage...

Malicious code in tailwind-animatecss-uniform (npm)

tailwind-animatecss-uniform 2.0.7 was published to npm on 2026-09-28 by the account ares0320. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment repository...

MAL-2026-17665 Malicious code in animatecss-tailwind-adapter (npm)

animatecss-tailwind-adapter 2.0.6 was published to npm on 2026-07-28 by the account grant587holloway. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment...

Malicious code in animatecss-tailwind-adapter (npm)

animatecss-tailwind-adapter 2.0.6 was published to npm on 2026-07-28 by the account grant587holloway. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment...

Malicious code in animatecss-tailwind-bridge (npm)

animatecss-tailwind-bridge 2.0.6 was published to npm on 2026-09-13 by the account bennetwild. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment repository...

MAL-2026-17666 Malicious code in animatecss-tailwind-bridge (npm)

animatecss-tailwind-bridge 2.0.6 was published to npm on 2026-09-13 by the account bennetwild. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment repository...

MAL-2026-17667 Malicious code in tailwind-animatecss-uniform (npm)

tailwind-animatecss-uniform 2.0.7 was published to npm on 2026-09-28 by the account ares0320. The package is part of a fake job interview campaign that targets developers, using the same method as the "Contagious Interview" campaign. A fake company sends a take-home coding assessment repository...

Security Bulletin:morgan HTTP Request Logger Middleware: Unicode Line Separator Log Forge Vulnerability

Summary morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 Next Line, U+2028 Line Separator, and U+2029 Paragraph Separator. An unauthenticated remo...

Security Bulletin:Axios Node.js HTTP Adapter Proxy Credential Leakage Vulnerability in 0.32.0 and 1.16.0

Summary Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios' Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header...

EUVD-2026-93569

Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server...

crawlee

Una biblioteca de web scraping y automatización de navegadores Crawlee cubre tu rastreo y scraping de principio a fin y te ayuda a construir scrapers confiables. Rápido. Tus crawlers parecerán humanos y pasarán desapercibidos ante las protecciones modernas contra bots, incluso con la configuració...