EUVD-2026-26993

VM2 Has a Sandbox Escape Issue via SuppressedError...

CVE-2026-43870

Apache Thrift versions prior to 0.23.0 are susceptible to multiple vulnerabilities, including Origin Validation Error , Path Traversal , HTTP Request/Response Splitting (via improper neutralization of CRLF sequences in HTTP headers), and Uncontrolled Resource Consumption . These issues stem from ...

CVE-2026-43870 Apache Thrift: Node.js web_server.js multi-vulnerability

Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal', Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting', Uncontrolled Resource Consumption vulnerability in Apache Thrift. This issue affects Apache Thrift:...

CVE-2026-24118

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0...

CVE-2026-26956 vm2: WASM Sandbox Escape (Node 25 only)

vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run obtains host process object and runs host commands with zero host cooperation. This issue has been patched in version 3.10.5...

JS Endpoint Extractor

Extract JS files and discover API endpoints/domains/keys from public client-side code. from kittysploit import import json import re from urllib.parse import urljoin, urlparse from lib.protocols.http.httpclient import Httpclient from lib.osint.jssecrets import extractsecrethints class...

CVE-2026-7645 ruvnet sublinear-time-solver MCP server.js export_state path traversal

A vulnerability was found in ruvnet sublinear-time-solver 1.5.0. Affected by this vulnerability is the function exportstate of the file src/consciousness-explorer/mcp/server.js of the component MCP Interface. The manipulation results in path traversal. The attack can be executed remotely. The...

CVE-2026-7643 ChatGPTNextWeb NextChat API Endpoint Next.js cross-domain policy

A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This impacts an unknown function of the file Next.js of the component API Endpoint. Executing a manipulation can lead to permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The exploit has been...

@clerk/chrome-extension (>=3.0.1-canary.v20260303211310, <=3.1.15-snapshot.v20260421194054), @clerk/expo (>=3.0.1-canary.v20260303211310, <=3.2.2-snapshot.v20260421194054) potentially affected by CVE-2026-42349 via @clerk/clerk-js (>=6.0.1-canary.v20260303211310, <=6.7.5-snapshot.v20260421194054)

@clerk/clerk-js NPM version =6.0.1-canary.v20260303211310, =3.0.1-canary.v20260303211310, =3.0.1-canary.v20260303211310, =3.2.2-snapshot.v20260421194054 Source cves: CVE-2026-42349 Source advisory: SNYK:JS-CLERKCLERKJS-16347748...

@clerk/chrome-extension (>=3.0.1-canary.v20260303211310, <=3.1.14-canary.v20260417194309), @clerk/expo (>=3.0.1-canary.v20260303211310, <=3.2.1-canary.v20260417194309) potentially affected by CVE-2026-42349 via @clerk/clerk-js (>=6.0.1-canary.v20260303211310, <=6.7.4-canary.v20260417194309)

@clerk/clerk-js NPM version =6.0.1-canary.v20260303211310, =3.0.1-canary.v20260303211310, =3.0.1-canary.v20260303211310, =3.2.1-canary.v20260417194309 Source cves: CVE-2026-42349 Source advisory: GHSA-W24R-5266-9C3C...

@clerk/chrome-extension (>=1.3.5, <=2.0.9), @clerk/clerk-expo (>=2.2.11, <=2.4.5) +12 more potentially affected by CVE-2026-42349 via @clerk/clerk-js (>=5.22.0, <=5.120.0)

@clerk/clerk-js NPM version =5.22.0, =1.3.5, =2.2.11, =0.1.0, =0.24.2-dev-clerk, =0.24.2-dev-clerk, =0.24.3-dev-ensure-cloud-token-6, =0.0.5, =0.4.2, =0.19.1-dev-clerk, =0.19.0-dev-clerk, =0.19.0-dev-clerk, =0.8.0, =0.24.2-dev-clerk, =0.19.1-dev-clerk, =0.19.8-dev Source cves: CVE-2026-42349 Sour...

@clerk/chrome-extension (>=1.3.5, <=2.0.9), @clerk/clerk-expo (>=2.2.11, <=2.4.5) +12 more potentially affected by CVE-2026-42349 via @clerk/clerk-js (>=5.22.0, <=5.120.0)

@clerk/clerk-js NPM version =5.22.0, =1.3.5, =2.2.11, =0.1.0, =0.24.2-dev-clerk, =0.24.2-dev-clerk, =0.24.3-dev-ensure-cloud-token-6, =0.0.5, =0.4.2, =0.19.1-dev-clerk, =0.19.0-dev-clerk, =0.19.0-dev-clerk, =0.8.0, =0.24.2-dev-clerk, =0.19.1-dev-clerk, =0.19.8-dev Source cves: CVE-2026-42349 Sour...

@clerk/chrome-extension (>=1.3.5, <=2.0.9), @clerk/clerk-expo (>=2.2.11, <=2.4.5) +12 more potentially affected by CVE-2026-42349 via @clerk/clerk-js (>=5.22.0, <=5.120.0)

@clerk/clerk-js NPM version =5.22.0, =1.3.5, =2.2.11, =0.1.0, =0.24.2-dev-clerk, =0.24.2-dev-clerk, =0.24.3-dev-ensure-cloud-token-6, =0.0.5, =0.4.2, =0.19.1-dev-clerk, =0.19.0-dev-clerk, =0.19.0-dev-clerk, =0.8.0, =0.24.2-dev-clerk, =0.19.1-dev-clerk, =0.19.8-dev Source cves: CVE-2026-42349 Sour...

@clerk/chrome-extension (>=3.0.1-canary.v20260303211310, <=3.1.15-snapshot.v20260421194054), @clerk/expo (>=3.0.1-canary.v20260303211310, <=3.2.2-snapshot.v20260421194054) potentially affected by CVE-2026-42349 via @clerk/clerk-js (>=6.0.1-canary.v20260303211310, <=6.7.5-snapshot.v20260421194054)

@clerk/clerk-js NPM version =6.0.1-canary.v20260303211310, =3.0.1-canary.v20260303211310, =3.0.1-canary.v20260303211310, =3.2.2-snapshot.v20260421194054 Source cves: CVE-2026-42349 Source advisory: OSV:GHSA-W24R-5266-9C3C...

PT-2026-36820

Name of the Vulnerable Software and Affected Versions @clerk/clerk-js versions prior to 5.125.10 @clerk/clerk-js versions prior to 6.7.5 @clerk/shared affected versions not specified @clerk/nextjs affected versions not specified @clerk/backend affected versions not specified Description...

Malicious code in @cap-js/postgres (npm)

Supply chain compromise of legitimate SAP packages published by threat actor "[email protected]" impersonating SAP toolchain maintainers. All four compromised packages share the same fingerprint: setup.mjs 4.4 KB and execution.js 11.1 MB bundled in the tarball, with a preinstall hook of "node...

MAL-2026-3177 Malicious code in @cap-js/postgres (npm)

Supply chain compromise of legitimate SAP packages published by threat actor "[email protected]" impersonating SAP toolchain maintainers. All four compromised packages share the same fingerprint: setup.mjs 4.4 KB and execution.js 11.1 MB bundled in the tarball, with a preinstall hook of "node...

Linux Distros Unpatched Vulnerability : CVE-2026-41636

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to...

Malicious Package

Overview graphbase-js is a malicious package. This package contains malicious code, and its content was not yet removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Embedded Malicious Code

Overview @cap-js/db-service is a CDS base database service Affected versions of this package are vulnerable to Embedded Malicious Code that conceals an obfuscated payload designed to steal developer credentials during the package installation. The malicious versions and their contents are activel...