Malicious code in @praveenvjpm/color-utils-7210 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b29d9da4319a314669b87ffd4bc0d736dbf3f4c16803e0363ecb36288c7bb2 On npm install, the package's preinstall hook executes install.js, which collects host identifiers os.hostname, process.cwd, username and reads flag...

MAL-2026-17651 Malicious code in @praveenvjpm/color-utils-7210 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b29d9da4319a314669b87ffd4bc0d736dbf3f4c16803e0363ecb36288c7bb2 On npm install, the package's preinstall hook executes install.js, which collects host identifiers os.hostname, process.cwd, username and reads flag...

CVE-2026-87685

An arbitrary file manipulation vulnerability exists in the Brocade Fabric OS WebTools management interface, affecting versions before 9.2.2d and 10.0.0 through 10.0.0a1 . The root cause is a failure to properly validate and sanitize a user-supplied status file path parameter during configuration ...

CVE-2026-87685

An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file pa...

CVE-2026-87669

A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite MAPS violation data across...

CVE-2026-87669

Brocade Fabric OS versions before 10.0.1 are susceptible to a missing authorization check in the REST API interface. This vulnerability allows an authenticated user, regardless of their role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite (MAPS) violation data a...

CVE-2026-87669

A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite MAPS violation data across...

Agentejo Cockpit < 0.11.2 - NoSQL Injection

Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. The $eq operator matches documents where the value of a field equals the specified value. id: CVE-2020-35846 info: name: Agentejo Cockpit 0.11.2 - NoSQL Injection author: dwisiswant0 severity: critic...

Veeam Backup & Replication - Unauthenticated

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution RCE. id: CVE-2024-40711 info: name: Veeam Backup & Replication - Unauthenticated author: rootxharsh,iamnoooob,DhiyaneshDK severity: critical description: | A deserializati...

CLEANSTART-2026-VX04129 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-54514 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-FQ60259 Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings

Security vulnerability affects the apache-hive package. Improper Handling of Highly Compressed Data Data Amplification vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings...

CLEANSTART-2026-YA06862 Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service (DoS) attack

CVE-2026-59282 affects multiple packages. Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a Denial of Service DoS attack. See references for individual vulnerability details...

CLEANSTART-2026-OX66799 If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape...

CVE-2026-39826 affects multiple packages. If a trusted template author were to write a tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the block. See references for individual...

CLEANSTART-2026-GJ18736 `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL re...

CVE-2026-79993 affects multiple packages. The deleteContainer opcode 0x14/20 is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes in the data tree regardless of the ACL restrictions on the znode or its parent. See references for...

CLEANSTART-2026-NN37649 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-59889 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-WQ14313 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-54518 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-QO27706 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-59888 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-LY52990 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-77310 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-ZG74825 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-54516 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...

CLEANSTART-2026-RR27418 jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor

CVE-2026-54515 affects multiple packages. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. See references for individual vulnerability details...