NPM: Payload: Remote Code Execution through first-register

NPM: Payload: Remote Code Execution through first-register vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...

NPM: Payload external upload trust validation issue

NPM: Payload external upload trust validation issue vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

NPM: Payload: Bypassed sanitization of user uploaded SVGs

NPM: Payload: Bypassed sanitization of user uploaded SVGs vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...

NPM: Payload: Incomplete validation during the upload file lifecycle

NPM: Payload: Incomplete validation during the upload file lifecycle vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...

NPM: Payload: Unauthenticated account-lockout denial of service

NPM: Payload: Unauthenticated account-lockout denial of service vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...

NPM: Payload: Unauthorized update to collection documents

NPM: Payload: Unauthorized update to collection documents vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...

NPM: Payload authentication token field handling issue

NPM: Payload authentication token field handling issue vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

NPM: Payload didn't enforce field-level password update restrictions

NPM: Payload didn't enforce field-level password update restrictions vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...

NPM: Payload: ReDoS in Multipart Content-Type Validation

NPM: Payload: ReDoS in Multipart Content-Type Validation vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

NPM: Payload vulnerable to API key disclosure through ordinary document reads

NPM: Payload vulnerable to API key disclosure through ordinary document reads vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

NPM: Payload relationship-query authorization bypass

NPM: Payload relationship-query authorization bypass vulnerability discovered by ? in WordPress Npm payload versions 3.90.0...

NPM: Payload: Token refresh and password reset responses may expose restricted user fields

NPM: Payload: Token refresh and password reset responses may expose restricted user fields vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

NPM: Payload: Field access control bypass on auth collections

NPM: Payload: Field access control bypass on auth collections vulnerability discovered by ? in WordPress Npm payload versions 3.0.0, 3.90.0...

NPM: Payload: SQL Injection in SQLite and Postgres

NPM: Payload: SQL Injection in SQLite and Postgres vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.88.0...

NPM: Payload: Untrusted redirect URL parameter exploit

NPM: Payload: Untrusted redirect URL parameter exploit vulnerability discovered by ? in WordPress Npm payload versions = 3.40.0, 3.88.0...

NPM: Payload: Polymorphic join queries could disclose hidden fields

NPM: Payload: Polymorphic join queries could disclose hidden fields vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

NPM: Payload: Password hashes use insufficient PBKDF2 iterations

NPM: Payload: Password hashes use insufficient PBKDF2 iterations vulnerability discovered by ? in WordPress Npm payload versions = 3.0.0, 3.90.0...

NPM: Payload: Sort queries could expose protected field information

NPM: Payload: Sort queries could expose protected field information vulnerability discovered by ? in WordPress Npm payload versions 3.88.0...

MAL-2026-13365 Malicious code in @stageflight-testbed/a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1072a48305e4a3b7d7da10a09c3842a6976dc23f48c48b743e62e71d35912e36 index.ts defines an exported telemetry function that 1 POSTs process.env and process.env.NODEAUTHTOKEN to a base64-hidden endpoint decoding to...

MAL-2026-5017 Malicious code in @mlspace/env-jupyter-server (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...