Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL

Summary A Path Traversal vulnerability in the Pydantic AI web UI allows an attacker to serve arbitrary JavaScript in the context of the application by crafting a malicious URL. If a victim clicks the link or visits it via an iframe, attacker-controlled code executes in their browser, enabling the...

Malicious code in @rdxportal/ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6715dad49a0781dc55e72ae77bd13276de1564d08cfd1c0a3c3aebf37b72acc The package @rdxportal/ui-components was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview @rdxportal/ui-components is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2026-796 Malicious code in @rdxportal/ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6715dad49a0781dc55e72ae77bd13276de1564d08cfd1c0a3c3aebf37b72acc The package @rdxportal/ui-components was found to contain malicious code. Source: ghsa-malware...

MAL-2026-802 Malicious code in @sbseg-plugin/qbo-web-app-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8f63d78f9aa713d6b2f068258ae34a81a6c8cfaa91890865506ce11475a44d5 The package @sbseg-plugin/qbo-web-app-ui was found to contain malicious code. Source: ghsa-malware...

EUVD-2026-5519

User interface ui misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network...

PT-2026-6789

Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.34.0 through 1.50.9 Description Pydantic AI contains a path traversal issue in its web UI. A crafted URL can be used by an attacker to serve arbitrary JavaScript within the application's context. This allows execution of...

PT-2026-6785

Name of the Vulnerable Software and Affected Versions Xmind affected versions not specified Description The software contains a flaw related to insufficient UI warnings when handling attachments. This could lead to remote code execution. There is no information about the number of potentially...

CVE-2026-0391

User interface ui misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-0391

User interface ui misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-0391

User interface ui misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network...

GHSA-F632-VM87-2M2F qdrant has arbitrary file write via `/logger` endpoint

Summary It is possible to append to arbitrary files via /logger endpoint. Minimal privileges are required read-only access. Tested on Qdrant 1.15.5 Details POST /logger Source code link endpoint accepts an attacker-controlled ondisk.logfile path. There are no authorization checks but authenticati...

Cross-site Scripting (XSS)

Overview nicegui is a Create web-based user interfaces with Python. The nice way. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ui.markdown function. An attacker can execute arbitrary JavaScript in the context of the user's browser by injecting malicious HTM...

Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability

User interface ui misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network...

@like-a-startup/matildex-chat (>=1.0.8, <=1.0.14), @n8n/chat (>=0.46.0, <=0.68.0) +3 more potentially affected by CVE-2026-25054 via @n8n/design-system (>=1.88.0, <=1.110.0)

@n8n/design-system NPM version =1.88.0, =1.0.8, =0.46.0, =1.0.0, =1.0.4 - navis-n8n-chat-ui 1.0.1 Source cves: CVE-2026-25054 Source advisory: SNYK:JS-N8NDESIGNSYSTEM-15225250...

wechat-monitor-poc

WeChat Message Monitoring PoC Project Project Description...

Malicious code in z-shop-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ac6f0b86a348586f517ef591a8fa3dd2ffffd919bcc1f6cfce912d06cba4aa5 The package z-shop-ui was found to contain malicious code. Source: ghsa-malware 7d3e42fd3ceecf78bbc9a794a0a36c38485ab8e91fe9892ffbd9c1db7f2a0fa0 Any...

Malicious Package

Overview z-shop-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-728 Malicious code in z-shop-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ac6f0b86a348586f517ef591a8fa3dd2ffffd919bcc1f6cfce912d06cba4aa5 The package z-shop-ui was found to contain malicious code. Source: ghsa-malware 7d3e42fd3ceecf78bbc9a794a0a36c38485ab8e91fe9892ffbd9c1db7f2a0fa0 Any...

GHSA-MHF6-PP52-8WQJ Moodle Cross-site Scripting (XSS) vulnerability

A flaw was found in Moodle. This Cross-site Scripting XSS vulnerability, caused by improper sanitization of AI prompt responses, allows attackers to inject malicious HTML or script into web pages. When other users view these compromised pages, their sessions could be stolen, or the user interface...