Malicious code in npmscript_tesstalert_unpkg (npm)

Source: amazon-inspector 5fa1adfe349e0a6092589e90bf38184b5769148bf42b4216fc714ad446ea747b The package ships a single browser JavaScript file declared as both main and unpkg, so any page embedding the package via the unpkg CDN loads this script. The script calls alert11 and then executes...

Malicious code in npmscript_tesstalert_unpkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c84336bfcd8d43d3f97942ded74e5a049c05e024f5a4b79dbee66acff1e1627 The package ships a single script exposed via the unpkg field for CDN loading into web pages. When executed in a browser, the script reads...

MAL-2026-16309 Malicious code in npmscript_tesstalert_unpkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c84336bfcd8d43d3f97942ded74e5a049c05e024f5a4b79dbee66acff1e1627 The package ships a single script exposed via the unpkg field for CDN loading into web pages. When executed in a browser, the script reads...

PT-2026-96044

Name of the Vulnerable Software and Affected Versions Canva Mobile App for HarmonyOS versions prior to 1.15.1 Description The application fails to restrict headers returned to an external origin operating within a privileged WebView. A privileged WebView is a system component that allows the...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

CVE-2026-90860: Improper Removal of Sensitive Information Before Storage or Transfer

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-77519: Insufficient Session Expiration

MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only its secret and active status, without enforcing the ispermanent and expiretime checks used by the standard chat API. A previously valid,...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...

CVE-2026-63373: Cross-Site Request Forgery (CSRF)

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToken and cookieToken whenever ISGAE is false, which affects self-hosted Docker and WAR deployments. A...

CVE-2026-61687: Improper Authentication

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauthstate session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an...

CVE-2026-94373: Improper Neutralization of Input During Web Page Generation

MISP contains a DOM-based cross-site scripting XSS vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string...

PT-2026-96159

Name of the Vulnerable Software and Affected Versions draw.io versions prior to 30.2.7 Description The OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java fails to compare stateToken and cookieToken when IS GAE is false, impacting self-hosted Docker and WAR deployments. This...

PT-2026-96065

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description The galaxy matrix statistics view app/View/Users/statistics galaxymatrix.ctp renders the galaxy name directly into HTML output using the sprintf function without proper HTML encoding. An authenticated...

PT-2026-96091

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description A DOM-based cross-site scripting XSS issue exists in the contextual menu JavaScript component. The ContextualMenu class populates HTML elements by assigning user-controllable values to the innerHTML...

CVE-2026-79317

A session invalidation flaw exists in x-ui 0.3.2 because the full user object is stored in a client-side signed cookie . The application's authentication mechanism only verifies that a user object can be retrieved from the cookie without re-validating against the database or checking a session ve...

ROS-20260921-73-0019

The vulnerability in curl relates to the provision of data elements for an erroneous session. Exploiting this vulnerability can allow a perpetrator to enhance their privileges...

EulerOS Virtualization 2.10.1 : python-requests (EulerOS-SA-2026-3850)

According to the versions of the python-requests packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made...

EulerOS Virtualization 2.10.0 : python-requests (EulerOS-SA-2026-3884)

According to the versions of the python-requests packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Requests is a HTTP library. Prior to 2.32.0, when making requests through a Requests Session, if the first request is made...

CVE-2026-94372: Improper Neutralization of Input During Web Page Generation

MISP contains a stored cross-site scripting XSS vulnerability in the default theme's Galaxies index page. When a MISP instance detects unknown custom or default galaxy clusters during synchronization, it renders sample tag names in an informational notice directed at site administrators. In the...

CVE-2026-79317: Insufficient Session Expiration

A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the...