4001 matches found
CVE-2026-21132: Undefined Security Weakness
Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability...
Malicious code in @zaka13/thing (npm)
@zaka13/[email protected] ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher zaka13. Its YXBp.js loader matches those packages' index-z2b7r4.js same sha256: it XOR-decodes endpoints with a fixed key, injects remote scripts from...
Malicious code in webpackbootstrapscripts (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
Astra Linux – Vulnerability in Chromium
Insufficient data validation in the Browser Switcher component of Google Chrome prior to version 124.0.6367.60 allowed a remote attacker to inject scripts or HTML into a privileged page via a malicious file. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Insufficient data validation in Blink Editing in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page...
Astra Linux – Vulnerability in Chromium
Insufficient data validation in the New Tab Page of Google Chrome prior to 95.0.4638.69 allowed a remote attacker to inject arbitrary scripts or HTML into a new browser tab through a crafted HTML page...
MAL-2026-16200 Malicious code in @zaka13/thing (npm)
@zaka13/[email protected] ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher zaka13. Its YXBp.js loader matches those packages' index-z2b7r4.js same sha256: it XOR-decodes endpoints with a fixed key, injects remote scripts from...
MAL-2026-16201 Malicious code in webpackbootstrap5 (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
Malicious code in webpackbootstrap5 (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
MAL-2026-16202 Malicious code in webpackbootstrapscripts (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
Malicious code in @zaka13/thing (npm)
@zaka13/[email protected] ships the same disguised in-browser proxy kit as webpackbootstrap5 and webpackbootstrapscripts by the same publisher zaka13. Its YXBp.js loader matches those packages' index-z2b7r4.js same sha256: it XOR-decodes endpoints with a fixed key, injects remote scripts from...
Malicious code in 2-loadsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cae23fe6221515577f9b639185cc745675d9711daad4da9fd6d5851aa27c08b5 The package consists of a minimal HTML wrapper index.html whose only behavior is to fetch content from a hardcoded, unpinned URL at...
MAL-2026-14366 Malicious code in 8-fetchsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0e6a4c6ee9a60609bc1a9e9f1eccfa2166aaf106ba50c35d51aac34ecb3f549 index.js and index.html contain a top-level IIFE that fetches https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight, parses the respons...
Malicious code in 8-fetchsight-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0e6a4c6ee9a60609bc1a9e9f1eccfa2166aaf106ba50c35d51aac34ecb3f549 index.js and index.html contain a top-level IIFE that fetches https://bitbucket.org/p2p-alt-public/p2p-emis/raw/main/GameWebSight, parses the respons...
SUSE CVE-2026-17724
Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: High...
SUSE CVE-2026-17728
Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...
SUSE CVE-2026-17878
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...
SUSE CVE-2026-17962
Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Low...
CVE-2026-17878
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-17845
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...