CVE-2026-54735

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafte...

EUVD-2026-50401

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafte...

CVE-2026-54735 prebid-server's request forgery vulnerability allows for possible host environment data extraction

Prebid Server is an open-source solution for running real-time advertising auctions in the cloud. Prior to version 4.4.0, certain bidder adapters in Prebid Server interpolate user-supplied parameters into outbound request URLs without properly validating host and subdomain values, allowing crafte...

CVE-2026-54735

Prebid Server (open-source in real-time advertising auctions) contains a vulnerability (CVE-2026-54735) in versions prior to 4.4.0 where certain bidder adapters interpolate user-supplied parameters into outbound request URLs without proper host/subdomain validation, enabling crafted bid requests ...

Malware Injection

prebid-universal-creative is vulnerable to malware injection. The vulnerability is due to the inclusion of crypto-related malicious code and the latest release, which allows an attacker to execute unauthorized cryptocurrency-related operations on affected systems...

EUVD-2025-27597

Malicious code in bioql PyPI...

CVE-2025-59039

Prebid Universal Creative PUC is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should s...

CVE-2025-59038

Prebid.js is a free and open source library for publishers to quickly implement header bidding. NPM users of prebid 10.9.2 may have been briefly compromised by a malware campaign. The malicious code attempts to redirect crypto transactions on the site to the attackers' wallet. Version 10.10.0 fix...

Embedded Malicious Code

Overview prebid-universal-creative is a javascript api to render multiple formats. This file is inserted into the prebid creative as a placeholder for the winning prebid creative. Affected versions of this package are vulnerable to Embedded Malicious Code. This package version contains malicious...

GHSA-M662-56RJ-8FMM Prebid-universal-creative latest on npm briefly compromised

Impact Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware detailed in the blog post below. This includes the extremely popular jsdelivr hosting of this file. Patches We unpublished the version on npm. Workarounds This has already been unpublished. See Prebid.js ...

Prebid-universal-creative latest on npm briefly compromised

Impact Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware detailed in the blog post below. This includes the extremely popular jsdelivr hosting of this file. Patches We unpublished the version on npm. Workarounds This has already been unpublished. See Prebid.js ...

MAL-2025-47027 Malicious code in prebid-universal-creative (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 28a458913f2a945444606a3dd030b993b23a6388274a01a2ecdea26478e1b1d9 This package was compromised and malicious code added as part of a phishing campaign...

Malicious code in prebid (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 14e7380eb0ee7e6be1b7896f1a961c6f7282199fcce42017c4003fc73695ee52 This package was compromised and malicious code added as part of a phishing campaign...

Malicious code in prebid-universal-creative (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 28a458913f2a945444606a3dd030b993b23a6388274a01a2ecdea26478e1b1d9 This package was compromised and malicious code added as part of a phishing campaign...

MAL-2025-47026 Malicious code in prebid (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 14e7380eb0ee7e6be1b7896f1a961c6f7282199fcce42017c4003fc73695ee52 This package was compromised and malicious code added as part of a phishing campaign...

CVE-2025-59039

Prebid Universal Creative PUC is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should s...

CVE-2025-59039 Prebid Universal Creative on npm briefly compromised

Prebid Universal Creative PUC is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should s...

CVE-2025-59039 Prebid Universal Creative on npm briefly compromised

Prebid Universal Creative PUC is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should s...

CVE-2025-59039 Prebid Universal Creative on npm briefly compromised

Prebid Universal Creative PUC is a JavaScript API to render multiple formats. Npm users of PUC 1.17.3 or PUC latest were briefly affected by crypto-related malware. This includes the extremely popular jsdelivr hosting of this file. The maintainers of PUC unpublished version 1.17.3. Users should s...

CVE-2025-59039

The CVE-2025-59039 incident concerns Prebid Universal Creative (PUC), a JavaScript API used to render multiple formats. NPM users of PUC 1.17.3 or the latest release were briefly affected by crypto-related malware, including via the popular jsDelivr hosting of the PUC file. In response, maintaine...