17810 matches found
MAL-2026-12210 Malicious code in statist-browser-typed-client-investing.product.loginandauthorization (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 508b23be5504ec69bf284c9a99bb7840e284c52862e07588b07807ebc4f0d71c index.js unconditionally requires./bridge on load. bridge.js selects a per-OS binary URL from a list of string-split-concealed hosts...
Malicious code in tinkoff-statist-browser-typed-client-investaccounting.events.templatepage.mainpage (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01843210cccc7d6327d870fbe2f8d53a493aa8d1db525de7473f30f97ea9dcdb On require of the package, index.js loads bridge.js which assembles Cloudflare Workers hostnames by joining split string fragments e.g...
Malicious code in statist-browser-typed-client-sme.platform.web.productsnavigation.events (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5adc0776701be44d8361a17020e910105fefdfd3c62a4b886455fa993b1e1781 Package's main entry loads adapter.js on require, which runs a bootstrap function at module load. It selects a platform-specific endpoint linuxx64,...
Malicious code in beaver-ui-form-object (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5b91edd276d95174766d639bab6981de8e07b4261e57668fc61f8e7dd96cc1e On require of the package, index.js loads polyfill.js whose top-level bootstrap fetches an opaque platform-specific binary over HTTPS from...
CVE-2026-70376 Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE
Pluck CMS's admin panel relies solely on a Referer-header comparison requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area...
Malicious code in shopping-shared-atom-mobile-cart-counter (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb2e70575aedbdc1f873900c0d6f187183ba2cc4088a93caea3d71ab78dc1260 [email protected] loads loader.js from index.js at require time. loader.js assembles C2 hostnames at runtime via...
The vulnerability of the escape() function in the sql-string.js ORM library by Sequelize allows a attacker to execute arbitrary SQL code.
The vulnerability of the escape function in the sql-string.js ORM library by Sequelize is related to the lack of security measures taken to protect the SQL query structure when processing TODATE and TOTIMESTAMP parameters. Exploiting this vulnerability could allow an attacker to execute arbitrary...
MAL-2026-11522 Malicious code in beaver-ui-form (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c303fcf069e3feb6dfa3d2b8ba7b7b2251c89d796bcf9fcd5d05e44849c64a0d Package advertises itself as a React UI toolkit but on require, helpers.js runs init at module load which selects a platform-specific URL, fetches a...
CVE-2026-18656
Kiro IDE on Windows prior to 1.0.228 is affected by an uncontrolled search path element vulnerability that can let a remote unauthenticated actor execute arbitrary code via a malicious project directory containing an executable, bypassing workspace trust protections when a local user opens the di...
NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
NPM: Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.2...
CVE-2026-69264
Prior to 3.1.3, Flowise CSVAgent interpolates an attacker-controlled segment of the csvFile data URI directly into a Python source-code template that is then executed by Pyodide. Because Pyodide is loaded with the default js bridge to globalThis, which on Node.js exposes eval and dynamic import,...
NPM: Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)
NPM: Flowise: CVE-2025-8943 Patch Bypass: npmconfigyes bypasses MCP environment variable blocklist Unauthenticated RCE vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
NPM: Flowise RCE via SQLite Record Manager Node
NPM: Flowise RCE via SQLite Record Manager Node vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...
CVE-2026-64633
A vulnerability allowing remote unauthenticated code execution on the agent host...
CVE-2026-64633
The CVE-2026-6463? document describes a vulnerability allowing remote unauthenticated code execution on the agent host. Based on the provided metrics, this is a CRITICAL (CVSSv4.0: 10.0) issue with a NETWORK attack vector, no privileges required and no user interaction needed. Impact is rated HIG...
CVE-2026-69255
Flowise (drag-and-drop LLM flow builder) versions prior to 3.1.3 are vulnerable to arbitrary code execution via the CSVAgent component. Attacker-controlled CSV data is interpolated directly into executable Python before being passed to Pyodide , bypassing the validatePythonCodeForDataFrame() deny...
Exploit for CVE-2023-31902
Mobile Mouse 3.6.0.4 RCE - Fix A corrected version of the Mob...
Alibaba Fastjson 1.2.68 < 1.2.84 RCE (CVE-2026-16723)
The version of Alibaba Fastjson installed on the remote host is 1.2.68 through 1.2.83. It is, therefore, affected by a remote code execution vulnerability: - A remote code execution RCE vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stoc...
CVE-2026-67856
An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via crafted CreateSubscription, CreateMonitoredItemsSampling, Publish, TransferSubscriptions, and DeleteSubscriptions requests...
CVE-2026-18733 Prompt injection bypasses shell tool consent gate in Strands Agents Tools
A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the noninteractive parameter to true, bypassing the human consent gate. To...