243329 matches found
BIT-POSTGRESQL-2026-14671 PostgreSQL refint plan cache type confusion executes arbitrary code
Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a C...
BIT-MONGODB-2026-13078 Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader
A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit...
MAL-2026-14288 Malicious code in @wizloft/harness-plugin-repository-files (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8197c156f5877fb7a024a3007bed2da30176f74960e3fa271cac4c4369f2705 dist/index.js of @wizloft/harness-plugin-repository-files ships a small legitimate wizloft-harness repository-files plugin followed at line 209 by a...
Malicious code in @wizloft/harness-plugin-repository-files (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8197c156f5877fb7a024a3007bed2da30176f74960e3fa271cac4c4369f2705 dist/index.js of @wizloft/harness-plugin-repository-files ships a small legitimate wizloft-harness repository-files plugin followed at line 209 by a...
Malicious code in @wizloft/harness-validation (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67b0fc0f25eb3d7852b52d7e7db50071ac08ddfb1965df306bbf87ebf295cbe1 dist/index.js appends a heavily obfuscated obfuscator.io-style payload string array 0x240a of length 303, decoder 0x4963, string-array rotation after...
MAL-2026-14289 Malicious code in @wizloft/harness-validation (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67b0fc0f25eb3d7852b52d7e7db50071ac08ddfb1965df306bbf87ebf295cbe1 dist/index.js appends a heavily obfuscated obfuscator.io-style payload string array 0x240a of length 303, decoder 0x4963, string-array rotation after...
MAL-2026-14285 Malicious code in @wizloft/harness (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3679ede1e874f59f4be963544c3df43069cd335b2f888753b7411e42c7a5d3dd dist/index.js — the package's main/exports entrypoint — presents 200 lines of TypeScript-compiled SDK facade followed by a single 40KB line of...
Malicious code in @wizloft/harness (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3679ede1e874f59f4be963544c3df43069cd335b2f888753b7411e42c7a5d3dd dist/index.js — the package's main/exports entrypoint — presents 200 lines of TypeScript-compiled SDK facade followed by a single 40KB line of...
Malicious code in @wizloft/harness-context (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0315deb3fb6b42e929a55eafaeaedbf1b428ee8873d4ae31f5ec9956f21b554 dist/index.js the package's declared main contains a heavily obfuscated obfuscator.io-style IIFE appended after the legitimate context-service code. ...
MAL-2026-14286 Malicious code in @wizloft/harness-context (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0315deb3fb6b42e929a55eafaeaedbf1b428ee8873d4ae31f5ec9956f21b554 dist/index.js the package's declared main contains a heavily obfuscated obfuscator.io-style IIFE appended after the legitimate context-service code. ...
Malicious code in mc-registry (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50f3053643e65c63fa7d8e3d5c48ae3d659650bd0052137099cd8674232780bc Package publishes as mc-registry with description 'Theta chain registry', but its README, badges, homepage layout, and package listing copy the...
MAL-2026-14294 Malicious code in mc-registry (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50f3053643e65c63fa7d8e3d5c48ae3d659650bd0052137099cd8674232780bc Package publishes as mc-registry with description 'Theta chain registry', but its README, badges, homepage layout, and package listing copy the...
CVE-2026-58082
The ISO-2022 encoding module used a stack buffer sized to MBLENMAX 6 bytes for intermediate character output. Some ISO-2022 variants can require up to 10 bytes per character, in which case conversions can trigger a stack buffer overflow of up to four bytes. An application that uses iconv3 to...
MAL-2026-14293 Malicious code in matrixflow-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45393245d9a2fca558d1bcb8b7c9d5263c16ff63e9a038a51169b720c85e1352 [email protected] is a typosquat/repackage of ml-matrix the UMD global is mlMatrix; homepage matrixflow-js.github.io does not correspond to the rea...
Malicious code in matrixflow-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45393245d9a2fca558d1bcb8b7c9d5263c16ff63e9a038a51169b720c85e1352 [email protected] is a typosquat/repackage of ml-matrix the UMD global is mlMatrix; homepage matrixflow-js.github.io does not correspond to the rea...
Malicious code in layer2-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bd6521302fb3f49a8c444435a33834be40a420972df3a03cadb5fdb3176a68f index.js line 75 decodes a base64-encoded string via Buffer.from..., 'base64'.toString'utf8' and passes the result to an evaluator, executing hidden...
MAL-2026-14278 Malicious code in layer2-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bd6521302fb3f49a8c444435a33834be40a420972df3a03cadb5fdb3176a68f index.js line 75 decodes a base64-encoded string via Buffer.from..., 'base64'.toString'utf8' and passes the result to an evaluator, executing hidden...
Malicious code in mutex-plus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a64e56572436d2ca889aa389887584bbeb3e67df09f30df6773cbfafc0188ca3 lib/Mutex.js contains a hidden branch inside runExclusive that, when a callback object carries a meta.jobId whose sha256 equals a hardcoded value...
MAL-2026-14282 Malicious code in mutex-plus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a64e56572436d2ca889aa389887584bbeb3e67df09f30df6773cbfafc0188ca3 lib/Mutex.js contains a hidden branch inside runExclusive that, when a callback object carries a meta.jobId whose sha256 equals a hardcoded value...