996628 matches found
MINI-2398-3WG6-H27P
Bulletin has no description...
CVE-2026-19906 pkp pkp-lib API Key Generation APIProfileForm.php setData entropy
A weakness has been identified in pkp pkp-lib 3.3.0/3.4.0/3.5.0. This vulnerability affects the function setData of the file classes/user/form/APIProfileForm.php of the component API Key Generation. Executing a manipulation of the argument apiKey can lead to insufficient entropy. The attack may b...
MAL-2026-14068 Malicious code in depcruise-wrap-stream-in-html (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bce3c6c9707df3626f30cbf434aa298d1df5cda4cf7b06b76ad4c92d04004a1c [email protected] is a hollow package: index.js is module.exports = and the name mimics an internal helper of dependency-cruiser...
MAL-2026-14067 Malicious code in upload-to-gcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4094f90a9780964738c1b9aea702c5554c802fba03f1a7e28c0703531dd04590 [email protected] runs a postinstall lifecycle script on npm install that collects host identifiers os.hostname, process.platform, process.arch, No...
MAL-2026-14066 Malicious code in akamaijs-sensorv1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9524ba80283c25fe34b7a9630fc0f65ac8cf112e33a50aa4cbaac19239fcc267 The package advertises itself as an Akamai Bot Manager sensor generator, but its main entry conceals its real behavior. index.js contains a comment...
MAL-2026-14065 Malicious code in akamai-sensor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1a8cc3668ec9751c1ef60bf602f1e08f2f2fdf8dce999e442c484458f932178 Package published under a name impersonating Akamai's sensordata anti-bot SDK. index.js contains a /... / comment whose body is encoded in invisible...
MAL-2026-14064 Malicious code in @finaxis/common-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f708a31239d3dc7490906a4a41f5ccb3cb76c99f89bc87b5ad5884939bb2d308 Package is published with a README copied from lodash v4.18.1 and keywords 'lodash','lodash-js', but the sole shipped module dist/common-js.js is a...
CGA-JX6V-QVH6-V92X
Bulletin has no description...
MAL-2026-14058 Malicious code in adxaa (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52685b4948dce286ad5cf0bbf4d0a7c8cf6b6a87ebfc2f70e20dbea685ab62c9 The tarball stages an obfuscated JavaScript payload i.js, with an un-obfuscated copy in original.js that gates on window.location.href containing...
MAL-2026-14057 Malicious code in @openrepl/shared (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fcd297122e7aac00cd0d3d92fcb5f1fc00b6c558571a037b5447eb64bd443b8 package.json declares a preinstall hook node index.js that runs automatically on npm install. index.js shells out via childprocess to execute curl -X...
MAL-2026-14060 Malicious code in fastly-vcl-language-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f77be5ce1488e7867223b63fd5c90060e98d6a44325ff2f71bed2b61653d649 The package declares scripts.preinstall = 'node vishu.js', which runs unconditionally on npm install. vishu.js fetches the installer's public IP via...
MAL-2026-14063 Malicious code in twilio-hackerone-poc-afe6937c (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6790435b096935699da3234140accc517ced689047a68e698cae06288939eed9 On npm install, preinstall/postinstall scripts execute id, read environment variables including AWSLAMBDALOGSTREAMNAME, list /var/task, and read pare...
MAL-2026-14061 Malicious code in hunterone-build-probe-9210 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f27c0ce93b98a1c9d602604eef2a625c6a7c2ebb7a1be38eeeaf06deb4e436e probe.js runs automatically via package.json preinstall and postinstall hooks "node probe.js || true". On execution it collects os.hostname,...
MAL-2026-14062 Malicious code in tw-pkgprobe-7731 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12551ba52a9605fc8ce1e13b750671d201dcf2a6e23d03f5a23b15236f2fa49b On preinstall/postinstall, probe.js checks whether cwd matches a Twilio Serverless build path /tmp/AC/ and, if so, copies daemon.js to...
CVE-2026-19898 VictoriaMetrics VMAuth Authentication Endpoint main.go requestHandler excessive authentication
A vulnerability was found in VictoriaMetrics up to 1.146.0. Impacted is the function requestHandler of the file app/vmauth/main.go of the component VMAuth Authentication Endpoint. Performing a manipulation results in improper restriction of excessive authentication attempts. The attack is possibl...
MAL-2026-14059 Malicious code in autbank-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c4077e84d7c02b7a8259ade848e89f9fd07ba0db7fb06bbaaa0c6e75f3e007d On npm install, preinstall.js enumerates process.env for keys matching credential substrings KEY, SECRET, TOKEN, PASSWORD, AWS, API, CREDENTIAL, AUTH...
MAL-2026-14056 Malicious code in gunzip-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d410844f9db44f33c2f674456c727d4c46402ad8f4de02a036fec3b099b2737b [email protected] is a near-empty npm package typosquat of the well-known gunzip-maybe / gunzip family whose package.json declares its sole dependency...
CVE-2026-19897 mangroup dtale Login Endpoint auth.py login excessive authentication
A vulnerability has been found in mangroup dtale up to 3.22.0. This issue affects the function Login of the file dtale/auth.py of the component Login Endpoint. Such manipulation leads to improper restriction of excessive authentication attempts. The attack can be executed remotely. This attack is...
MAL-2026-14054 Malicious code in depcruise-fmt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08675f5d3de6c71d05588ae719204e2919ffac836aaada2f24b2b61bed2291ba depcruise-fmt ships an empty module index.js exports and declares its only dependency, ltidisafe, as an arbitrary HTTPS tarball hosted at...
MAL-2026-14053 Malicious code in depcruise-baseline (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91cc3a6ca908fc8beff657d21068318704e4576cb3778c360036ab5bfef4e56c [email protected] has a name resembling dependency-cruiser/depcruise but ships an empty index.js and declares its sole runtime dependency as ...
CVE-2026-19896 mangroup dtale Flask Session Cookie app.py build_secret_key random values
A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function buildsecretkey of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's complexit...
MAL-2026-14055 Malicious code in harmony-app-toolkit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84c12fe64417829f19a3ad302001c909c0825b09e1c4a25c957eb8aa96997f49 The package declares a preinstall lifecycle script preinstall.js that reads a hex-encoded command from preinstall.json, decodes it with...
MAL-2026-14052 Malicious code in require-i18next (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b5f50249e747ea23b84fdc6baa2202e9d786a872fd7d9a545017dc6fc5ad788 The package's preinstall.js reads a hex-encoded command string from preinstall.json, decodes it with Buffer.fromhex, 'hex', and passes the result to...
MINI-587F-MQ79-VX38
Bulletin has no description...
MINI-F7CM-HP7Q-MM4J
Bulletin has no description...
MINI-26MC-3868-3H82
Bulletin has no description...
MINI-H378-PR4J-QXXV
Bulletin has no description...
MINI-4WCW-QJ8G-V4RV
Bulletin has no description...
MINI-P8CH-VQ75-GJM5
Bulletin has no description...
MINI-J5V5-VMF4-M893
Bulletin has no description...
MINI-7Q72-P7F5-GXXH
Bulletin has no description...
MINI-48Q5-7QCC-4JP9
Bulletin has no description...
MINI-R8X8-RC8X-7Q75
Bulletin has no description...
MINI-V9RW-2R8Q-CC96
Bulletin has no description...
MINI-RRP8-95W4-9MPF
Bulletin has no description...
MINI-QCW6-CFQQ-2JVQ
Bulletin has no description...
MINI-8GV9-78F7-JVCC
Bulletin has no description...
MINI-X55R-F7JG-7H32
Bulletin has no description...
MINI-7FC8-89W8-CWG9
Bulletin has no description...
MINI-R2XP-386C-GVJ6
Bulletin has no description...
MINI-2QG2-689V-XMJ3
Bulletin has no description...
MINI-W3QQ-MFW9-MJ3C
Bulletin has no description...
MINI-3X55-47G8-9VQ5
Bulletin has no description...
MINI-3WG4-F4RG-GCGF
Bulletin has no description...
MINI-MHJ4-JXFJ-236V
Bulletin has no description...
MINI-VQC7-F47Q-PCQ2
Bulletin has no description...
MINI-W7Q5-GFW7-464M
Bulletin has no description...
MINI-XWFC-4HXM-R4R4
Bulletin has no description...