Malicious Package

Overview web-vitals-polyfill-core-v1 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-92424

The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and abo...

EUVD-2026-89621

The Content Egg WordPress plugin before 11.9.0 does not verify that a user running its bulk content-import feature is authorized for the import preset they select, and switches to the preset author's identity before creating the resulting post, allowing users with contributor-level access and abo...

EUVD-2026-89628

The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens...

CVE-2026-103101

Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible...

EUVD-2026-89577

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via postcontent Parameter data-label DOM Sink in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output...

CVE-2026-103101

Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible...

EUVD-2026-89576

Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible...

CVE-2026-103101

The Pexip Infinity software versions 30.0 through 40.x before 41.0 are impacted by a vulnerability caused by improper input validation in the web server . A malicious attacker can exploit this flaw to render a Pexip Infinity node inaccessible . No specific remediation steps, exploit code, or in-t...

CVE-2026-103101

Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible...

MAL-2026-17303 Malicious code in web-vitals-polyfill-core-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38311c0f483e9485a7b5e8aa7f9a093a40203d8e1a025c0bf5850c2874cffdfa The package name mimics the widely-used web-vitals polyfill but the tarball ships disk/index.min.js, a base64-wrapped service-worker payload...

Malicious code in web-vitals-polyfill-core-v1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38311c0f483e9485a7b5e8aa7f9a093a40203d8e1a025c0bf5850c2874cffdfa The package name mimics the widely-used web-vitals polyfill but the tarball ships disk/index.min.js, a base64-wrapped service-worker payload...

EUVD-2026-89492

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a specially crafted request for a different resource which they are authorized to...

EUVD-2026-89493

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI...

[SECURITY] Fedora 45 Update: epiphany-51.0-1.fc45

Epiphany is the web browser for the GNOME desktop. Its goal is to be simple and easy to use. Epiphany ties together many GNOME components in order to let you focus on the web content, instead of the browser application...

CVE-2026-103049

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1...

CVE-2026-103051

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS. This issue affects Mediawiki - CentralNotice extension: before 1.46.1, 1.45.5, 1.43.10...

CVE-2026-18105

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI...

CVE-2026-103050

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS. This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10...

UBUNTU-CVE-2026-103051

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS. This issue affects Mediawiki - CentralNotice extension: before 1.46.1, 1.45.5, 1.43.10...