MAL-2026-10479 Malicious code in node-fsmetrics-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b67fad1d72f63941a3973df07e6cbd980c9e3c3bbe5041818f58b9be07d6b7e9 The tarball contains archive-sender.js, which tars the directory /root/.codex, splits the archive into 200MB chunks, and uploads each chunk by runnin...

MAL-2026-10470 Malicious code in @uw010010/vite-tree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 280687ad50e03b43bf7f26df6afb1a8fb794eb486c126b2368f37c6b76625318 The package @uw010010/vite-tree impersonates the upstream vite package: its package.json verbatim copies vite's author 'Evan You', description...

MAL-2026-10460 Malicious code in datavaultx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbf831f155eb2a6d04427e5cc3cd239055844e80c3b02576a5d546e4e7ab42b6 On require of the package's main entry auth.js - lib/writer.js, the module attempts require'auth-gen-next'; on failure it invokes execSync'npm instal...

GHSA-W2W5-W2PW-R929 NukeViet: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Summary A stored cross-site scripting XSS vulnerability exists in NukeViet CMS versions 4.x through 4.5.08. A low-privileged authenticated user can store a JavaScript payload in their profile's display name fields. The payload executes in the browser of any visitor — including administrators — wh...

PYSEC-2026-2530 joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization

RFC7797 b64=false JWS payloads bypass JWSRegistry payload-size limits during deserialization Summary Testing revealed that joserfc accepts oversized RFC7797 b64=false JWS payloads without applying JWSRegistry.maxpayloadlength. The normal JWS compact and flattened JSON paths reject payloads above...

PYSEC-2026-2694 Open WebUI has XSS via SVG in /api/v1/channels/webhooks/{webhook_id}/profile/image

As part of our research on improving our AI pentest, we have uncovered the following issue in Open WebUI. We've manually verified and tided up the report, but you can also find the original agent finding at the bottom of this report. Summary The channel webhook create/update flow accepts arbitrar...

PYSEC-2026-2516 Home Assistant has stored XSS in history-graphs

Summary The "remaining charge time"-sensor for mobile phones imported/included from Android Auto it appears is vulnerable to the same issue as CVE-2025-62172. This also indicates that any sensor showing their name in the history-graph, is likely to be vulnerable to this issue. Details Another...

PYSEC-2026-3045 Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit

Impact A maliciously crafted QPY file containing a malformed symengine serialization stream as part of the larger QPY serialization of a ParameterExpression object can cause a segfault within the symengine library, allowing an attacker to terminate the hosting process deserializing the QPY payloa...

MAL-2026-10451 Malicious code in gifuct (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 965f65127a6b6d2a6865e91efe6a878ae1e076b9ef4de23152aef4ee6080038b Package name typosquats the legitimate gifuct-js GIF parser and re-exports it as cover. On module load, code reconstructs the host...

Malicious code in gifuct (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 965f65127a6b6d2a6865e91efe6a878ae1e076b9ef4de23152aef4ee6080038b Package name typosquats the legitimate gifuct-js GIF parser and re-exports it as cover. On module load, code reconstructs the host...

MAL-2026-10449 Malicious code in auth-gen-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49e38202e2579f6591dbc161817859bb99a212cbf6c1e5482b3271acf8fc4de0 The package impersonates the pino logger README assets, keywords, and internal filenames such as lib/proto.js, lib/multistream.js, lib/redaction.js,...

MAL-2026-10452 Malicious code in markdown-editable-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6b15669732f3eaec42e12c5f8d41a8f74d595fc04f709804de9768cb1719a94 The package's package.json declares a preinstall hook node index.d.js that runs automatically on npm install. The script in index.d.js base64-decodes...

MAL-2026-10446 Malicious code in react-markable-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da0db97919f41757fe4bcdc456d52ec0ecfbb89741438e5805a7bf5188b022c5 [email protected] is a typosquat of markdown-table declared repo field wooorm/markdown-table. package.json declares a preinstall hook that...

MAL-2026-10447 Malicious code in remarkable-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 464cab930bcf948abf49517f78a3ee1abb8b89c8f9c90f199bd3446c902d8e1e The package's preinstall script runs index.d.js, which reconstructs the identifier 'eval' from a character-code array 101,118,97,108 and base64-decod...

Malicious code in markable-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd358271f202636f12507f09da4e8f00c900ba46c9dca25a5a0526d35b75bf1d [email protected] declares scripts.preinstall = 'node index.d.js'. index.d.js base64-decodes an embedded payload and invokes it through an...

CVE-2026-6847 Unauthenticated Remote Code Execution in ThemisNETPanel

Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. The application exposes an endpoint that allows unauthenticated attackers to upload arbitrary PHP files by providing a base64-encoded payload and to execute arbitrary co...

MAL-2026-10440 Malicious code in type-context (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c6706d0ad662da8d23eaf47c64780a777f3ec215d8864caf1e0962289463efb The package presents itself as a logger module.exports.pino, keywords fast/logger/stream/json, pino-like sibling files...

Malicious code in animated-css-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2156080aac79f8a251ee10f328ba8df515372cd8db293d45655ff32d54f61257 The package presents itself as a PostCSS plugin for animate.css, but its main export src/plugin.js createPlugin synchronously triggers...

MAL-2026-10432 Malicious code in animated-css-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2156080aac79f8a251ee10f328ba8df515372cd8db293d45655ff32d54f61257 The package presents itself as a PostCSS plugin for animate.css, but its main export src/plugin.js createPlugin synchronously triggers...

CVE-2026-6850

Mattermost versions 11.7.x = 11.7.2, 11.6.x = 11.6.4, 10.11.x = 10.11.19 fail to validate the length and content of message attachment field values, which allows an authenticated attacker to cause a denial of service for all users in a channel via a post containing a specially crafted payload tha...