@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +133 more potentially affected by CVE-2026-48068 via @grpc/grpc-js (>=1.14.0, <=1.14.3)

@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =0.26.4, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.2.2, =0.10.0, =0.56.0 and more Source cves: CVE-2026-48068 Source advisory: MEND:CVE-2026-48068...

js-x-ray v@nodesecure/[email protected]

!slsa...

CVE-2026-59891

The CVE-2026-59891 entry concerns sigstore-js prior to 0.7.1. getRegistryCredentials() reads Docker config credentials and selects an entry by substring match of the target registry, which can cause credentials for one registry to be sent to a different registry whose hostname has a matching subs...

CVE-2026-48816

A flaw was found in sigstore-js. The software derives a transparency-log timestamp from tlogEntries.integratedTime and uses it to validate certificate validity windows and satisfy timestampThreshold. For bundle v0.2, a transparency log tlog entry can be inclusion-proof-only, meaning the inclusion...

CVE-2026-48069

A flaw was found in @grpc/grpc-js, a pure JavaScript gRPC client and server library. An invalid incoming compressed message can cause a client or server process to crash. This vulnerability affects all clients and servers that use @grpc/grpc-js, and no workaround is available. An unauthenticated...

CVE-2026-15697 svgdotjs svg.js npm Package API EventTarget.on prototype pollution

A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated...

Security Bulletin: IBM Jazz Reporting Service is affected by Cross-site Scripting (XSS) of spin.js

Summary Spin.js is used internally by IBM Jazz Reporting Service. The vulnerability arises from the spin function, which can trigger multiple alert dialogs per target element. Vulnerability Details CVEID:CVE-2026-3884 DESCRIPTION: Versions of the package spin.js before 3.0.0 are vulnerable to...

CVE-2026-59869

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

Malicious code in @flcik/flick.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31c087b34f156cf2b5ae7070222a57e2d760d68f9c4c73721c2800eb7b6bf62 @flcik/[email protected] replicates the discord.js public API surface FlickClient, GatewayIntentBits, SlashCommandBuilder, ButtonStyle, MessageFlags, th...

CVE-2026-48069: Uncaught Exception

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process that uses @grpc/grpc-js to crash. This issue is fixed in...

CVE-2026-48068: Uncaught Exception

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created using @grpc/grpc-js to crash. This issue is fixed in...

CVE-2026-48816: Insufficient Verification of Data Authenticity

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries.integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind...

CVE-2026-48758: Improper Verification of Cryptographic Signature

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature...

CVE-2026-48815: Improper Verification of Cryptographic Signature

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications...

CVE-2026-59891: Insufficiently Protected Credentials

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target registry string. Because this is a substring...

PT-2026-58289

Name of the Vulnerable Software and Affected Versions sigstore-js versions prior to 0.7.1 Description The getRegistryCredentials function reads credentials from the Docker config file and selects an entry by checking if any configured auth key contains the target registry string. Due to the use o...

CVE-2026-59801

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under...

CVE-2026-58486 HedgeDoc: Denial-of-service via YAML alias expansion in note frontmatter

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1.11.0, HedgeDoc was vulnerable to a YAML alias bomb due to unsafe processing of the note frontmatter. HedgeDoc parsed frontmatter with js-yaml.load js-yaml v3 via @hedgedoc/meta-marked, which...

CVE-2026-59801 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under...

Malicious code in node-fsmetrics-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9958558a30dea32a3b0fc2e48bb775433e1f12b339030a8d21872ad058bc28ff On require, index.js hex-decodes the URL http://152.53.120.90/cmd and starts a background loop that polls /cmd/commands, executes returned strings vi...