MAL-2026-4360 Malicious code in @aledan007/tester (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab03e3eef2f59f358cdaacedf2d9facb12077110c5402ad36aad6e3581e66439 The bundled server file dist/server/index.js contains a hardcoded reference to the attacker-controlled domain https://evil.attacker-example.com...

EUVD-2026-31150

TeleJSON prior to 6.0.0 contains a DOM-based cross-site scripting vulnerability in the parse function that allows attackers to execute arbitrary JavaScript by delivering a crafted JSON payload containing a malicious constructor-name property value. The custom reviver passes the constructor name...

CVE-2026-47099

TeleJSON prior to 6.0.0 contains a DOM-based cross-site scripting vulnerability in the parse function that allows attackers to execute arbitrary JavaScript by delivering a crafted JSON payload containing a malicious constructor-name property value. The custom reviver passes the constructor name...

CVE-2026-47099 TeleJSON < 6.0.0 DOM-based XSS via parse() Function

TeleJSON prior to 6.0.0 contains a DOM-based cross-site scripting vulnerability in the parse function that allows attackers to execute arbitrary JavaScript by delivering a crafted JSON payload containing a malicious constructor-name property value. The custom reviver passes the constructor name...

CVE-2025-15369

creationtimestamp| type| source ---|---|--- 2026-05-20 17:32:06+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mmcgqexd632c...

crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages

A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...

GHSA-53M7-2WRH-Q839

creationtimestamp| type| source ---|---|--- 2026-05-20 16:56:46+00:00| seen| https://bsky.app/profile/Whiskeyomega.cupoftea.social.ap.brid.gy/post/3mmceqyeaiq72 2026-05-20 21:03:40+00:00| seen| https://bsky.app/profile/tesaguri.fedibird.com.ap.brid.gy/post/3mmcsknmcbx22...

CVE-2026-45443

creationtimestamp| type| source ---|---|--- 2026-05-20 15:06:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmc6l7vybf2i...

CVE-2026-46387

creationtimestamp| type| source ---|---|--- 2026-05-20 14:15:33+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmc3qtiaud2c...

CVE-2026-45766

creationtimestamp| type| source ---|---|--- 2026-05-20 14:15:32+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmc3qtiaud2c...

CVE-2026-45761

creationtimestamp| type| source ---|---|--- 2026-05-20 14:15:31+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmc3qtiaud2c...

CVE-2026-45751

creationtimestamp| type| source ---|---|--- 2026-05-20 14:15:31+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmc3qtiaud2c...

CVE-2026-5817

creationtimestamp| type| source ---|---|--- 2026-05-20 14:10:26+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mmc3hreejc2q 2026-05-22 22:21:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhxukvbeu2i 2026-05-22 23:00:13+00:00| seen|...

WordPress Broadstreet plugin <= 1.52.2 - Authenticated (Subscriber+) Private Post Meta Disclosure vulnerability

Authenticated Subscriber+ Private Post Meta Disclosure vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin Broadstreet Ads versions = 1.52.2...

MAL-2026-4431 Malicious code in @scp3500/openvl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fee1ab6796d8af462e9f00e82a28545b72eae4d9d9f0ab0f36ca4b09cd29487c scripts/mcpserver.js loads childprocess, fs, and http, reads from process.env, and issues HTTP POST requests to a hardcoded external destination at...

Malicious code in @scp3500/openvl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fee1ab6796d8af462e9f00e82a28545b72eae4d9d9f0ab0f36ca4b09cd29487c scripts/mcpserver.js loads childprocess, fs, and http, reads from process.env, and issues HTTP POST requests to a hardcoded external destination at...

CVE-2026-8610

creationtimestamp| type| source ---|---|--- 2026-05-20 12:32:20+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mmbvxx73b22a...

CVE-2026-47783

creationtimestamp| type| source ---|---|--- 2026-05-20 11:52:24+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mmbtqvnqvt2k 2026-05-21 23:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmfllxhfro2s...

CVE-2026-6405

creationtimestamp| type| source ---|---|--- 2026-05-20 11:27:58+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmbsf4lnut2c 2026-05-20 13:32:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mmbzda6puq2s...

SUSE-SU-2026:21737-1 Security update for iproute2

This update for iproute2 fixes the following issue - CVE-2024-58251: denial of service via terminal escape sequences bsc1254324. Changes for iproute2: - support display of bound but unconnected sockets bsc1204562. - avoid spurious cgroup warning bsc1234383. - add post-6.4 follow-up fixes...