CVE-2026-48834

Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing. Users...

GHSA-R4W5-6PFG-JXP5 Electron: ProtocolResponse.url reuses the default session cache instead of the registering session

Impact When a custom protocol handler returned a ProtocolResponse with a url and no session, Electron made the upstream request through defaultSession instead of the session that handled the protocol. A cached response could then be reused across otherwise isolated session partitions. Apps that u...

MAL-2026-13286 Malicious code in dolyame-boxy-atom-bnpl-dolyame-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c249dddf9e2ab4659fe99f1945e7b6dd832178da7b207fa86923d8c23ae60143 On require, adapter.js selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of several Cloudflare Workers mirrors...

Malicious code in dolyame-boxy-atom-desktop-bnpl-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b63e38f9a4be0ffccf426124ce23e7d5c0ddfde68cc81ad44cbfe75ef22c31c The package's index.js silently loads loader.js via a swallowed try/catch try require'./loader'; catch . loader.js assembles one of three Cloudflare...

MAL-2026-13178 Malicious code in dolyame-ui-react-dom-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c3f53ba29324123e792649baa012f91a2a980590dea560599490d8020b6274b On require of the package's main entry, helpers.js selects a platform-specific target path, fetches an opaque binary over HTTPS from author-controlle...

MAL-2026-12853 Malicious code in bigops-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36dcb322eace39209bb0092ab7ea7c658481887a48eff948f116bfb7909ec131 Loading the package's main entry point auto-invokes helpers.js init, which downloads an OS-specific binary from obfuscated Cloudflare Workers...

MAL-2026-13107 Malicious code in bpm-foundation-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39a9ca2287ec8bbf000796cf1f41fbc088f7d8a3a37cd8d8eadc970cf19abc91 On require'bpm-foundation-common', index.js loads loader.js which assembles C2 hostnames via runtime string-joining e.g...

CVE-2026-71267

microtar's mtarwritefileheader and mtarwritedirheader functions src/microtar.c copy a caller-supplied entry name into the 100-byte field of a stack-allocated mtarheadert via strcpyh.name, name, with no check that strlenname is less than 100 before the copy...

CVE-2026-16022

@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync. A user-controlled project-name argument is inserted into the shell command without proper...

MAL-2026-12798 Malicious code in npm-groat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eda7da760041a49d296b9a6e8cfa90ec4b7e5daecebbf50c88d41f7fd559a1b1 [email protected] declares a postinstall script that executes dist/config.js on npm install. That script performs an outbound fetch to...

Malicious code in chai-as-rendered (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 545ba2341881e666831e81156a815fdfac738830ec2918167e4c5fd3c42294bf Typosquat of chai-as-promised. The package's exported middleware spawns a detached child process lib/caller.js that fetches a JSON payload from a...

Malicious code in eventea-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a8a332e38d2400d3c15f34636f55191ca61c1d52ff49fbead378b9f9239de756 index.js unconditionally requires vendor.js on load. vendor.js selects a platform-specific payload path, downloads an opaque native binary over HTTPS...

EUVD-2026-53355

Stirling-PDF's POST /api/v1/convert/url/pdf endpoint ConvertWebsiteToPDF.java was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints html/pdf, file/pdf, markdown/pdf. The endpoint validates only that the initial...

EUVD-2026-53335

@oblique/cli 15.4.0 contains an OS command injection vulnerability in the project creation functionality. The CLI constructs shell commands through string concatenation and executes them with execSync. A user-controlled project-name argument is inserted into the shell command without proper...

EUVD-2026-53313

DjangoCRM's toggledefaultsorting view is the only route in common/urls.py that is not wrapped in loginrequired or staffmemberrequired, and it redirects to a caller-supplied nexturl GET parameter after only checking secureurlnexturl, which merely verifies the target host matches the current site's...

Malicious code in geocode-quick (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f8f109952f61867c1ca8819f7a151b89de305ff4b157f49400ef4428019419 The package advertises itself as a geocoding CLI but, on every invocation of the tool, executes env via execFile to dump the full process environment...

Malicious code in scrollbar-hide-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f19e1731b591552a096b108703702b9663c1bbb8cf9c2ff6fc048f8582e8607 The package's main entry dist/index.js appends an obfuscated payload — wrapped in evalatob... with require targets and URLs hidden in \uXXXX escapes ...

Unchecked Input for Loop Condition

Overview Affected versions of this package are vulnerable to Unchecked Input for Loop Condition in the disposition process. An attacker can exhaust system resources by sending specially crafted frames with large or illegal ranges, resulting in excessive CPU usage. Remediation Upgrade...

CVE-2026-68077 Apache Qpid Broker-J: Unbounded disposition range handling can lead to denial of service

An authenticated attacker can craft a disposition frame with large or illegal ranges causing excessive CPU usage due to naive range handling, leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the...

Malicious Package

Overview @zzzgenesis00/bip39-mnemonic is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...