Malicious code in tailwind-modernanimation (npm)

Source: amazon-inspector 05dc9224b2caa7b39b542fc713ebc5cdd8d8718f3ae86ffced6872507e6818ce The package advertises itself as a Tailwind CSS animation plugin, but src/index.js appends an evalatob'...' call at module top level after the plugin export, concealed by a long run of trailing spaces and...

Malicious code in tailwindcss-forms-style (npm)

Source: amazon-inspector 8948b9d83b1d0eb952b8364b7a15d32efb78d6bed43956bc67a42e151dcfc7a2 Package typosquats @tailwindcss/forms. On require'tailwindcss-forms-style', src/index.js runs evalatob... on a base64 blob appended after module.exports. The decoded payload queries public Ethereum RPC...

CVE-2026-79748

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations a...

Malicious code in tailwind-modernanimation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05dc9224b2caa7b39b542fc713ebc5cdd8d8718f3ae86ffced6872507e6818ce The package advertises itself as a Tailwind CSS animation plugin, but src/index.js appends an evalatob'...' call at module top level after the plugin...

MAL-2026-15635 Malicious code in tailwind-modernanimation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05dc9224b2caa7b39b542fc713ebc5cdd8d8718f3ae86ffced6872507e6818ce The package advertises itself as a Tailwind CSS animation plugin, but src/index.js appends an evalatob'...' call at module top level after the plugin...

Malicious code in mfa.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e77a8cf665e78e07a5228adb91c3e204f7f1317a65c8dca3ef7c240f705fe436 lib/cache.js reconstructs a base64-fragmented URL decoding to https://limbomail.com/api/attachment/l4TIRPOsaUxR.603-vhKDRdgKl3RalNTVUZYGPsJy2Y and, t...

CVE-2026-79748 MCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations a...

CVE-2026-79748

MCPHub , a hub for centrally managing and orchestrating multiple MCP servers/APIs, contains a command injection vulnerability in the POST /api/servers and PUT /api/servers/:name endpoints prior to version 0.12.15. These endpoints spawn configured stdio processes via child_process.spawn but lack a...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for August 2026

Summary Multiple vulnerabilities were addressed in IBM Process Mining 2.2.0 IF002 Vulnerability Details CVEID:CVE-2026-41608 DESCRIPTION: Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0...

PT-2026-83878

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbd cron process parameter without authentication. Attackers can predict the...

PT-2026-83946

MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies. Prior to version 0.12.15, the POST /api/servers and PUT /api/servers/:name endpoints in MCPHub create/update MCP server configurations a...

Linux Distros Unpatched Vulnerability : CVE-2026-18699

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's query planner could allow an authenticated user with read-level privileges to cause the server process to terminate unexpectedly by...

Fedora 44 : kbd (2026-71a5fbb962)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-71a5fbb962 advisory. Fix openvt -u process matching to be more conservative CVE-2026-72693 Tenable has extracted the preceding description block directly from the Fedora...

Linux Distros Unpatched Vulnerability : CVE-2026-26448

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the same TCP connection, and subsequently another client or a...

CVE-2026-82367

Exposure of Data Element to Wrong Session vulnerability in ash-project ashgraphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql.Subscription.Batcher.dosend/5 reads the resolved batch from the process dictionary via Process.get:batchresolved and then...

EUVD-2026-68283

Exposure of Data Element to Wrong Session vulnerability in ash-project ashgraphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql.Subscription.Batcher.dosend/5 reads the resolved batch from the process dictionary via Process.get:batchresolved and then...

CVE-2026-82367 Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic

Exposure of Data Element to Wrong Session vulnerability in ash-project ashgraphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql.Subscription.Batcher.dosend/5 reads the resolved batch from the process dictionary via Process.get:batchresolved and then...

CVE-2026-82367

CVE-2026-82367 is a re-entrant data-exposure bug in ash_graphql (ash-project), affecting versions 1.4.0 through before 1.11.0 . The root cause lies in AshGraphql.Subscription.Batcher.do_send/5, which reads and deletes the process-dictionary key :batch_resolved without namespacing it per run. On t...

EEF-CVE-2026-82367 Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic

Summary Exposure of Data Element to Wrong Session vulnerability in ash-project ashgraphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql.Subscription.Batcher.dosend/5 reads the resolved batch from the process dictionary via Process.get:batchresolved...

CVE-2026-82367 Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic

Exposure of Data Element to Wrong Session vulnerability in ash-project ashgraphql can deliver one subscription's resolved records to a different subscriber's topic. AshGraphql.Subscription.Batcher.dosend/5 reads the resolved batch from the process dictionary via Process.get:batchresolved and then...