MAL-2026-13146 Malicious code in dolyame-ui-codemods (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa4592f76ef0995b4e3c8b0cc15c00862cf594cbaebbfcd2bf25d2640bbf6012 On require'dolyame-ui-codemods', index.js loads polyfill.js, which reconstructs remote hostnames from split string-fragment arrays joined at runtime...

Malicious code in checkout-desktop-promocode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19310e46ffcb5a99a81bab29f7260407b9fb6af5af72bdd8f3b9f7819cc6ffda On require of checkout-desktop-promocode, index.js loads vendor.js which selects a per-platform endpoint, downloads a binary over HTTPS from obfuscat...

CVE-2026-30269

Improper access control in Doorman v0.1.0 and v1.0.2 allows any authenticated user to update their own account role to a non-admin privileged role via /platform/user/username. The role field is accepted by the update model without a manageusers permission check for self-updates, enabling privileg...

CVE-2026-4287 Tiandy Easy7 Integrated Management Platform Endpoint queryResources sql injection

A security flaw has been discovered in Tiandy Easy7 Integrated Management Platform 7.17.0. The affected element is an unknown function of the file /rest/devStatus/queryResources of the component Endpoint. Performing a manipulation of the argument areaId results in sql injection. The attack can be...

PT-2024-27471 · User Oidc · User Oidc

Name of the Vulnerable Software and Affected Versions: user oidc app versions prior to 3.0.0 user oidc app versions prior to 4.0.0 user oidc app versions prior to 5.0.0 Description: The issue is related to missing access control on the ID4me endpoint, allowing an attacker to register an account a...