MAL-2026-1016 Malicious code in js-multer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50fbd8b0061a32bc73c0f643e53d0522b03117bda560c40b279b8cdebe5a1100 The package js-multer was found to contain malicious code. Source: ghsa-malware 330a991375f32abf73368d5d321c5a485cd844db42ccaa02388ebe61bc013376 Any...

MAL-2026-880 Malicious code in console-style-pro0o0o0o (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fe7407a5523ef7efe6bec615d9601fe978b9e5de59d19d7e8e2ff054c5e09e9 The package console-style-pro0o0o0o was found to contain malicious code. Source: ghsa-malware...

MAL-2026-828 Malicious code in @reimorg/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b715386d6331820f6ad234559c9b38d82c81bd4e0ff2ba695a8f509a4a0b9d81 The package @reimorg/config was found to contain malicious code. Source: ghsa-malware 01b3357726455a4a24aecc9b4255f7ea96cab434482b28a50e5d48f06e3cf1d...

PT-2026-7411

Name of the Vulnerable Software and Affected Versions Azure AI Language Authoring SDK version 1.0.0 Description A flaw exists in the Azure AI Language Authoring SDK that allows an unauthorized attacker to execute code over a network. This is due to the deserialization of untrusted data. The issue...

PT-2026-6916

Name of the Vulnerable Software and Affected Versions jsbroks COCO Annotator versions up to 0.11.1 Description A flaw exists in jsbroks COCO Annotator that can lead to a denial of service. This issue affects the Endpoint component and involves the /api/info/long task file and an unknown function...

TP-Link Systems Inc. VIGI Series IP Camera

RISK EVALUATION Successful exploitation of this vulnerability could result in unauthorized users gaining administrative access to affected closed circuit television cameras. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this...

Malicious code in tablescene (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 75f24eaea6c977e93d35c431f9bedc66b7757fd5c5635425c28801dad3b50de9 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in...

Malicious code in kwp-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff8db163baaddfa00a5ad4be917d7b8147bbc3b1b0807694614ab14ebac6c431 The package kwp-analytics was found to contain malicious code. Source: ghsa-malware 57994b2b00321595177d73893abdd66ed3fdbe0f5ff0a7565c59efb6126d9e7a...

MAL-2026-560 Malicious code in transform-async-to-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3375385fb6c066445341256f9ce616582a713468ea0649853056c24b4aaf1776 The package transform-async-to-generator was found to contain malicious code. Source: ghsa-malware...

Malicious code in universal-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd5b2c6fa041d1cac8de4366ee4973b7748dd0ef711771280413bd57d4318175 The package universal-provider was found to contain malicious code. Source: ghsa-malware...

MAL-2026-357 Malicious code in chai-bin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70584b6893352163c2a0c5341a2e577feaec7949d8719725a62e0d87e5b1d542 The package chai-bin was found to contain malicious code. Source: ghsa-malware a1636ea6e8016a1000135fcda28819cd75c13f4a95933606b7e792737fe630f0 Any...

MAL-2026-358 Malicious code in dot-env-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6b904cb582cf9170852021ecdcf038d94bbdeba48b650873716c45f7b64428a The package dot-env-buffer was found to contain malicious code. Source: ghsa-malware c4ad07e4f6d317d9cc416752d30839302c835d6eb881eed62ddba910fcd47945...

EUVD-2026-3212

A vulnerability was detected in pbrong hrms 1.0.1. The affected element is the function UpdateRecruitmentById of the file /handler/recruitment.go. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used...

CVE-2026-1147 SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System api_patient_schedule.php cross site scripting

A vulnerability was found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This affects an unknown part of the file /php/apipatientschedule.php. Performing a manipulation of the argument Reason results in cross site scripting. It is possible to initiate the attac...

CVE-2025-37168

Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Successful exploitation of this vulnerability could allow an unauthenticated remote malicious actor to delete arbitrary files within the affected system and...

Malicious code in express-sessions-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50976a5a79aa6e9a71eee66f3a74059d86a7620d670cf19ad43c9eb3619b0c2e The package express-sessions-id was found to contain malicious code. Source: ghsa-malware...

QuestDB UI's Web Console is Vulnerable to Cross-Site Scripting

A security flaw has been discovered in questdb ui up to 1.11.9. Impacted is an unknown function of the component Web Console. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading t...

CVE-2026-0821 quickjs-ng quickjs quickjs.c js_typed_array_constructor heap-based overflow

A vulnerability was determined in quickjs-ng quickjs up to 0.11.0. This vulnerability affects the function jstypedarrayconstructor of the file quickjs.c. Executing a manipulation can lead to heap-based buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed a...

Malicious code in aws-target-mediator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ebc5003f75ac973cedd53d212f4d9b3dc016b36e43b24ca0a10e77e485b9141 The package aws-target-mediator was found to contain malicious code. Source: ghsa-malware...

Malicious code in scrollbar-stylecss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1feac6b077daf292c9f1be24ff5b49cfd07da882dda73a98dcba56ea0a4c903 The package scrollbar-stylecss was found to contain malicious code. Source: ghsa-malware...