CVE-2022-41040

CVE-2022-41040 Microsoft Exchange vulnerable to server-side request forgery Payload : /autodiscover/autodiscover.json?@URL/&Email=autodiscover/autodiscover.json%3f@URL /autodiscover/autodiscover.json?@%d.v1.COLLABHERE/&Email=autodiscover/autodiscover.json%3f@%d.v1.COLLABHERE...

PT-2026-105490

Summary The openUrl function in @a2ui/web core passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button,...

Malicious code in integration-web-core--socle (npm)

Source: ossf-package-analysis 4bee6dc4af217ab7789d50b0fed6b7d01749bf9ef8c725c1dfee59c068f9af3b The OpenSSF Package Analysis project identified 'integration-web-core--socle' @ 1.4.2 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in ee-web-core (npm)

The package ee-web-core was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in cwt-booking-web-core (npm)

The package cwt-booking-web-core was found to contain malicious code. --- Credit: OpenSSF source...

Malicious Package

Overview ee-web-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious code in avx-web-core (npm)

--- Credit: OpenSSF source...

CVE-2026-10032 Arbitrary JavaScript Execution via openUrl in @a2ui/web_core

The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...

PT-2026-105545

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-72qq-p3r5-f7wq. This link is maintained to preserve external references. Original Description The openUrl function in @a2ui/web core passes an agent-controlled URL directly to window.open without validating the...

PT-2026-67730

Name of the Vulnerable Software and Affected Versions @a2ui/web core affected versions not specified Description The openUrl function fails to validate the URI scheme before passing a URL to window.open. A malicious agent can provide a javascript: URI via the url argument of a Button component's...

Malicious code in @nordea-web/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23add8238a8d9299d1e684ff54f1cfdf0d5f1068d9092ece70333debfc3a6570 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @nordea-web/core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in @nordea-web/core

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-11217 Malicious code in @nordea-web/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23add8238a8d9299d1e684ff54f1cfdf0d5f1068d9092ece70333debfc3a6570 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview Tessa.Web.Core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-7050 Malicious code in @bmg-web/bmg-core (npm)

--- -= Per source details. Do not edit below this line.=-...

Malware in @serviceshub/x-web-core

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2025-208903

The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vulnerability that may allow attackers to execute arbitrary code. Vulnerable components include Terrapack TkWebCoreNG:: 1.0.20200914, Terrapack TKServerCGI 2.5.4.150, and Terrapack...

CVE-2025-67260

The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vulnerability that may allow attackers to execute arbitrary code. Vulnerable components include Terrapack TkWebCoreNG:: 1.0.20200914, Terrapack TKServerCGI 2.5.4.150, and Terrapack...

Terrapack Arbitrary File Upload

Terrapack software suffers from an arbitrary file upload vulnerability that may allow attackers to execute arbitrary code. Affected software includes Terrapack TkWebCoreNG version 1.0.20200914, TKServerCGI version 2.5.4.150, and TpkWebGIS - Client version 1.0.0...