CVE-2026-55879

OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from any visitor using a public project key, stores them in ClickHouse without output encoding, and later renders them in the authenticated...

CVE-2026-55879: Improper Neutralization of Input During Web Page Generation

OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from any visitor using a public project key, stores them in ClickHouse without output encoding, and later renders them in the authenticated...

Malicious code in gtm-tracking-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e849bf91f82dbd6013c54266e0b8ab5b8107604190298ca59817cdf94fe2aba6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in gtm-tracking-sdk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2022-3493 Malicious code in gtm-tracking-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e849bf91f82dbd6013c54266e0b8ab5b8107604190298ca59817cdf94fe2aba6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...