CVE-2026-19023

The CVE describes an untrusted pointer dereference in the render_bin_output function of the h5dump tool from HDF5, caused by processing a variable-length string dataset with more than one element dumped in binary mode. Affected versions are cited as HDF5 before 2.1.1 (and related entries referenc...

CVE-2026-19023 HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...

CVE-2026-19023 HDF5 h5dump Untrusted Pointer Dereference in Binary Output of Variable-Length String Datasets

Untrusted pointer dereference in the renderbinoutput function in the h5dump tool in HDF5 before 2.3.0 allows attackers to cause a denial of service via a variable-length string dataset with more than one element dumped in binary mode, which corrupts the per-element stride calculation and causes...

MAL-2026-12877 Malicious code in bnpl-blocks-atom-bnpl-image-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 893348e540e6c6a6cb856324bb2379d838bead9f4d2ceab1ae7c3509094871f6 On require of the package, index.js loads compat.js, which reconstructs C2 hostnames from string-split arrays e.g.,...

MAL-2026-12976 Malicious code in bnpl-blocks-markdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 161162281afaf68fd193e2521beaf60d32c850e29cc276192497eee09646a55a On require'bnpl-blocks-markdown', index.js loads bootstrap.js which downloads a platform-specific binary from runtime-assembled Cloudflare Workers...

Malicious code in clients-structure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dc3674a31787baaf2d3d554336f507ecce91da7b4d527a170c50cd720024d48 On require of clients-structure, index.js loads ext.js which selects a platform-specific endpoint, fetches a binary from a rotating list of anonymous...

MAL-2026-12717 Malicious code in devplatform-jscodeshift-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92dcd946aaaf9b57795f9a94877df34a69ac39828620c58e2cf4b72cd7a9c253 On require, index.js loads loader.js, which reconstructs Cloudflare Workers hostnames from split string fragments e.g...

MAL-2026-12738 Malicious code in devplatform-react-query-clients (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 192681d10673d935bcba617102ed5581cc928ba8ebedda203cebe5d33d7f067a On require of the package, index.js loads adapter.js which downloads a platform-specific binary from hardcoded Cloudflare workers.dev endpoints...

MAL-2026-12802 Malicious code in shift-v4-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e86de9ce7bfa06a95a3e4d6c68f188d2c8c8b35537645e94a2fb3fee4c1e0e81 [email protected] is a typosquat of the scoped package @shiftforex/shift-sdk-v4 self-identified as such in a comment inside dist/index.js. Its...

MAL-2026-12317 Malicious code in @cryptosrvc/shift-sdk-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbcb95c5f9f9305e86cbeb749787dc845933c6273e91ab2d69138dee6fc2900a package.json declares a postinstall script node dist/recon.js || true that runs automatically on npm install. dist/recon.js collects installer host...

CVE-2026-71235 Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine re/lua.go performs no input validation at all and preloads dangerous libraries: db arbitrary database access, ioutil file I/O, ...

Malicious code in twork-data-services-eacq-company-service-v2-api-v1-identifiers-crm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a35dfc30f1440b5057988bc44c6bdaecee3c33317799c140354ed7adae679838 index.js unconditionally requires setup.js on module load. setup.js reconstructs C2 hostnames at runtime from split string fragments resolving to...

MAL-2026-12185 Malicious code in pfa-autotests-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0d767d6c21c9a23c7190f1479b572e85e1c257f1786c96c76c8029c8169b4fd On require, pfa-autotests-reporter loads adapter.js which selects a platform-specific path, fetches a binary over HTTPS from one of four Cloudflare...

MAL-2026-12142 Malicious code in beaver-ui-ai-chat-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c18143c270ff7461d38c50147f24245f346aecf7cc07e4883590c9c677b13809 Package is advertised as a UI chat layout toolkit but its index.js unconditionally requires a setup.js that side-loads a 77 KB module internally...

PT-2026-68345

Name of the Vulnerable Software and Affected Versions HDF5 versions prior to 2.3.0 Description An untrusted pointer dereference exists in the render bin output function of the h5dump tool. This occurs when a variable-length string dataset containing more than one element is dumped in binary mode...

CVE-2026-70471

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Variables for the active workspace are fetche...

CVE-2026-70471

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Variables for the active workspace are fetche...

CVE-2026-70471 Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure

Flowise is a drag-and-drop user interface for building customized large language model LLM flows. Prior to 3.1.3, Flowise injects $vars into the code execution sandbox without requiring variables:view, bypassing the permission-protected Variables API. Variables for the active workspace are fetche...

NPM: Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

NPM: Flowise: CVE-2025-8943 Patch Bypass: npmconfigyes bypasses MCP environment variable blocklist Unauthenticated RCE vulnerability discovered by ? in WordPress Npm flowise-components versions = 3.1.2...

Incomplete List of Disallowed Inputs

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs through insufficient validation of environment variables in the validateEnvironmentVariables process. An attacker can execute arbitrary code with the privileges of the...