Malicious code in devplatform-spa-plugin-module (npm)

Source: amazon-inspector 638c4246220ea7f9a595c145c76940e7e060920ef251ab2c67ca814b9ab93378 On require of the package's main entry, polyfill.js executes init which reconstructs destination hostnames via array-join string splits e.g. "oob-worke","r.cf100-416.worker","s.","dev".join"", selects a...

Malicious code in devplatform-spa-plugin-module-loader (npm)

Source: amazon-inspector 902d3def6570c6efcdc3310f49ae60d22d25dce47bc8f6c8bb26292191c817a8 On require, index.js unconditionally loads platform.js, which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts oob-worker.cf103-070.workers.dev, oob-worker.cf99-9b3.workers.dev,...

Malicious code in cluster-css-minimizer-webpack-plugin-module-rehype (npm)

Source: amazon-inspector 991ffbbf4b4673ac58b1abe23a1b69f79be0f6f847edb54bbd400cebef716b6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CVE-2026-63642

creationtimestamp| type| source ---|---|--- 2026-08-18 18:35:08+00:00| published-proof-of-concept| https://github.com/MagicMirrorOrg/MagicMirror/security/advisories/GHSA-998g-7v5w-cr7g...

UBUNTU-CVE-2026-68520

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...

CVE-2026-23681 Missing Authorization check in a function module in SAP Support Tools Plug-In

Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could invoke specific function modules to retrieve information about the system and its configuration. This disclosure of the system information could assist the attacker to plan...

EUVD-2024-52740

Malicious code in bioql PyPI...

CVE-2024-55088

GetSimple CMS CE 3.3.19 is vulnerable to Server-Side Request Forgery SSRF in the backend plugin module...

CVE-2020-22841

Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious JavaScript code execution via the plugin name input field in the plugin module...

CVE-2020-21585

Vulnerability in emlog v6.0.0 allows user to upload webshells via zip plugin module...

Think Twice Before You Act: Enhancing Agent Behavioral Safety with Thought Correction

LLM-based autonomous agents possess capabilities such as reasoning, tool invocation, and environment interaction, enabling the execution of complex multi-step tasks. The internal reasoning process, i.e., thought, of behavioral trajectory significantly influences tool usage and subsequent actions...

CVE-2024-55088: Cross-Site Request Forgery (CSRF)

GetSimple CMS CE 3.3.19 is vulnerable to Server-Side Request Forgery SSRF in the backend plugin module...

CVE-2024-55088

GetSimple CMS CE 3.3.19 is vulnerable to Server-Side Request Forgery SSRF in the backend plugin module...

CVE-2024-55088

GetSimple CMS CE version 3.3.19 is vulnerable to Server-Side Request Forgery (SSRF) within its backend plugin module . This flaw allows an attacker to forge requests originating from the server, which could lead to unauthorized access or actions. No specific exploit details or in-the-wild exploit...

CVE-2024-55088

GetSimple CMS CE 3.3.19 is vulnerable to Server-Side Request Forgery SSRF in the backend plugin module...

Malware in eslint-plugin-module-dependencies

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-10661 Malicious code in eslint-plugin-module-dependencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware afc57b3b316c94a93252629b2c608c1e0dfd28fa51024ff8e2957db8efb8d48b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-1689 WooCommerce Tools <= 1.2.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Module Deactivation

The WooCommerce Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the woocommercetooltogglemodule function in all versions up to, and including, 1.2.9. This makes it possible for authenticated attackers, with subscriber-level access...

CVE-2022-42125

Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module...

CVE-2022-42125

Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module...