MAL-2026-13595 Malicious code in dolyame-ui-postcsscustomproperties (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8be08d3eb5601ca7f7b5f74c34e3fd0ebba91f0b72dea8ab4b0642bb9695c0c On require of the package, shim.js and lib/telemetry.js reached via the main entry select a platform-specific payload, download a binary over HTTPS...

Malicious code in dolyame-ui-noindex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1886afe7141f5c9f5ecfc4fd9869c1f47d47e7170e1fd4247a57959dcd880e On require, index.js loads./ext which selects a platform-specific payload linuxx64/arm64, darwin, win32, downloads an unsigned binary over HTTPS from...

Malicious code in bnpl-blocks-atom-bnpl-image-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abfb9fc4e628aff9ca7ab9df6b7a2b65c27eb1a094e4d64ff002a98f35eb58e1 On require, index.js loads bridge.js which selects a platform-specific asset path, fetches a binary over HTTPS from runtime-assembled Cloudflare...

MAL-2026-13513 Malicious code in eacq-cdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0fdb6bb562df94959130d84e06dc14aa40e9347c60da24dd32ce672024c2e0aa Requiring the package executes init.js, which selects a platform-specific payload path and fetches an executable over HTTPS from Cloudflare Workers...

Malicious code in bnpl-blocks-atom-bnpl-reviews-counter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 28f2136092f1d01017b4a4d573e4a22de7c4fc7d44b07d8e3a1f24ce57be6c65 On require of this package, index.js loads platform.js which runs at import time. It reconstructs a list of destination hosts by string-splitting...

MAL-2026-13007 Malicious code in bnpl-blocks-mobile-bnpl-tab-buttons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34cc219a990162733e49aafc255a8abe4c4acd3fc56bce77ae31800fd4791678 On require of the package, index.js side-loads adapter.js which selects a platform-specific asset, downloads bytes over HTTPS from hostnames...

MAL-2026-12587 Malicious code in checkout-postpone-until-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dda2bcf0b52999de23bed014cc8b4fbbe08dea5331db90dc732f2428e373445 On require of the package, index.js loads./vendor.js which assembles Cloudflare Workers hostnames oob-worker.cf.workers.dev family via array-join...

MAL-2026-12765 Malicious code in devplatform-spa-plugin-dom-render (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 091445440fe06ab01a0a3fb29eca1c376b69c5daa5583f6a73edfe964b2b9afa index.js unconditionally requires./platform on module load. platform.js assembles endpoint hostnames at runtime by joining string fragments evading...

MAL-2026-12376 Malicious code in express-middle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91c0275a4e65fc4ed9930cb89002f2c4ebc50163b292f552703c4ea6a9940567 package.json declares postinstall: node index.js, which fires automatically on npm install. index.js is a heavily obfuscated bundle obfuscator.io-sty...

Malicious code in twork-data-services-customer-api-v2-customer-vip-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd6182daf75450f1e553f81c3979a275c481690e27d04712285b85a25ebadc3b On require of this package, index.js loads platform.js which selects a platform-specific payload linuxx64/linuxarm64/darwin/win32, downloads an opaqu...

MAL-2026-12156 Malicious code in bigops-chat-transfer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d8d11b7e8abee5caddc5c2f1765fa7f10d40c8cce0ef1cafed55fe31537be94 On require of bigops-chat-transfer, platform.js reconstructs one of three Cloudflare workers.dev hostnames from split string fragments...

SUSE CVE-2026-46600

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

EUVD-2026-47093

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: Core. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Application Object...

EUVD-2026-46968

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft component: Security. The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise C...

EUVD-2026-46691

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracl...

EUVD-2026-46486

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Metadata Plugin. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle...

EUVD-2026-46482

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent Next Gen. Supported versions that are affected are 13.5 and 24.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle...

CVE-2026-60153

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Console. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to...

CVE-2026-46999

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Discovery Framework. Supported versions that are affected are 13.5 and 24.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise...

PT-2026-62169

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Self Update Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise...