Malicious code in boxy-get-retry-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2bd36db17d5636ee0cd74be0ca5d35fc190e75749360c297ecd52821d74ab8b8 On require, index.js delegates to helpers.js which selects a platform-specific asset path, downloads an opaque binary over HTTPS from obfuscated...

CVE-2026-17506

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

CVE-2026-67623

creationtimestamp| type| source ---|---|--- 2026-08-05 14:15:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/jze72nb5aends...

MAL-2026-12631 Malicious code in claims-patch-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c07292652ca72654d945a2833f8cf8915ea79f1ce665a0445938ff2605394c08 [email protected] presents an empty ClaimsPatchUrl shell class in index.js and unconditionally requires./compat.js on load. On require, compat....

Malicious code in claims-patch-url (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c07292652ca72654d945a2833f8cf8915ea79f1ce665a0445938ff2605394c08 [email protected] presents an empty ClaimsPatchUrl shell class in index.js and unconditionally requires./compat.js on load. On require, compat....

Malicious code in claims-replace-url-params (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfdefc5cd3c5418949e2da9656f7b93b174c5b8eb5fa64531736fbd5ae63b1f0 The package's public API in index.js is a no-op class whose only real effect is require"./adapter" on load. adapter.js selects a platform-specific...

CVE-2026-71294

creationtimestamp| type| source ---|---|--- 2026-08-05 14:00:38+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msdot46tz22p 2026-09-13 07:00:05+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/102176 2026-09-14 00:00:30+00:00| published-proof-of-concept|...

GHSA-PWXH-7358-JQ2X

creationtimestamp| type| source ---|---|--- 2026-08-05 13:31:17+00:00| seen| https://gist.github.com/alon710/63aaf77a9f4550ada3647ec00940f1b7...

EUVD-2026-53339

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

CVE-2026-17506 Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting

The Independent Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 404 notfoundurl tracking parameter in versions up to, and including, 2.15.0. This is due to the getcellcontent function applying urldecode after escurl when rendering the URL column for 404 entries...

CVE-2026-71259

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...

ROOT-APP-NPM-GHSA-J4MR-9XW3-C9JX GHSA-j4mr-9xw3-c9jx in base64-url - Patched by Root

Root has patched GHSA-j4mr-9xw3-c9jx in the base64-url package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-NSWG-ECO-434 NSWG-ECO-434 in base64-url - Patched by Root

Root has patched NSWG-ECO-434 in the base64-url package for Root:npm. Multiple fixed versions available...

MAL-2026-12797 Malicious code in multi-reqs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38937963f906d0bf3b4dac24a1a45f574aeb53cd2f268ffb9730d88bedf50bce The package's default export accepts token, password arguments and POSTs them, formatted as a Discord embed titled 'Yeni Hesap Bilgisi' with fields '...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...

MAL-2026-12510 Malicious code in anthropic-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector baee404f50ce2f767660b7f6cf21dec0df6b0d0da68b9bc39ce506f941f1f664 The package is presented as an Anthropic API setup helper npx anthropic-setup sk-ant-.... When invoked, it writes /.claude/settings.json with...

Malicious code in anthropic-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector baee404f50ce2f767660b7f6cf21dec0df6b0d0da68b9bc39ce506f941f1f664 The package is presented as an Anthropic API setup helper npx anthropic-setup sk-ant-.... When invoked, it writes /.claude/settings.json with...

MAL-2026-12786 Malicious code in dust-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e08146748974a55b50e565bc0ae7fc1788c9b8a28858536c697505032334310 On npm install, the package's preinstall script runs node callback.js, which collects os.hostname, os.userInfo.username, process.cwd,...

Malicious code in technical-challenge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6921f72a1b4fbaaba87fcbe3cb30137815e7e2bb932ffa794acd0010b8954c5f package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects installer-side data —...

tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve

A flaw was found in Apache Tomcat. This vulnerability, located in the rewrite valve, is due to improper handling of URL encoding hex encoding. A remote attacker could exploit this to bypass security constraints in certain configurations, potentially gaining unauthorized access or performing actio...