02-infrastructure (1.0.0), 02vue_toast_demo (>=1.0.0, <=1.0.4) +21453 more potentially affected by unknown CVE via js-yaml (>=3.0.0, <=3.15.0)

js-yaml NPM version =3.0.0, =1.0.0, =1.0.4, =5.0.0, =1.0.3, =2.0.0, =0.0.1, =0.0.2 - 23g-base-css 1.0.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-JSYAML-18593780...

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

Quadratic CPU consumption in !!omap resolution js-yaml 3.x and 4.x Summary resolveYamlOmap enforces key uniqueness for !!omap sequences with a linear scan objectKeys.indexOf... inside the per-element loop, making resolution On² in the number of entries. A modestly sized YAML document therefore...

02.aula (1.0.0), 0xrtest (1.0.0) +10558 more potentially affected by unknown CVE via js-yaml (>=4.0.0, <=4.3.0)

js-yaml NPM version =4.0.0, =0.2.0, =0.0.3, =4.11.0, =0.0.1, =1.1.9, =0.1.23, =0.1.4, =6.1.5, =0.2.0, =0.14.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-5P4M-2WFM-XMQJ...

02.aula (1.0.0), 0xrtest (1.0.0) +10558 more potentially affected by unknown CVE via js-yaml (>=4.0.0, <=4.3.0)

js-yaml NPM version =4.0.0, =0.2.0, =0.0.3, =4.11.0, =0.0.1, =1.1.9, =0.1.23, =0.1.4, =6.1.5, =0.2.0, =0.14.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-JSYAML-18593780...

NPM: JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

NPM: JS-YAML: Quadratic CPU consumption in !!omap resolution 3.x and 4.x — CVE-2026-59870 fix not backported vulnerability discovered by ? in WordPress Npm js-yaml versions = 3.0.0, 3.15.1...

Inefficient Algorithmic Complexity

Overview org.webjars.npm:js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the yaml.load process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially...

Inefficient Algorithmic Complexity

Overview js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the yaml.load process. An attacker can cause excessive CPU consumption and block the event loop by providing a specially crafted YAML...

GHSA-5P4M-2WFM-XMQJ JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

Quadratic CPU consumption in !!omap resolution js-yaml 3.x and 4.x Summary resolveYamlOmap enforces key uniqueness for !!omap sequences with a linear scan objectKeys.indexOf... inside the per-element loop, making resolution On² in the number of entries. A modestly sized YAML document therefore...

DoS (Denial of Service) js-yaml Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector o...

CVE-2026-56846

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system. Mitigation ...

Injection js-cookie Dependency in Jira Service Management Data Center

This High severity Injection vulnerability was introduced in versions 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Service Management Data Center. This Injection vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

Malicious code in nms-dashboard-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab87107c47e765b4214ccd31eac720d9d082b0cb5040d8acf90c8af00db5a601 [email protected] declares an npm install lifecycle hook scripts.install: "node index.js" that unconditionally requires ./lib/core inside a...

MAL-2026-13451 Malicious code in nms-dashboard-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab87107c47e765b4214ccd31eac720d9d082b0cb5040d8acf90c8af00db5a601 [email protected] declares an npm install lifecycle hook scripts.install: "node index.js" that unconditionally requires ./lib/core inside a...

CVE-2026-67550

A flaw was found in re2, a component that provides Node.js bindings for Google's RE2 regular expression engine. An attacker can exploit a vulnerability by manipulating the lastIndex parameter with a non-ASCII input. This manipulation can lead to an out-of-bounds heap read, causing the process to...

@ascua/electron (>=0.8.0, <=0.18.0), @eltmon/panctl (0.7.2-canary.3) +11 more potentially affected by CVE-2026-70603 via electron (>=40.0.0, <=40.8.5)

electron NPM version =40.0.0, =0.8.0, =4.0.0, =0.30.0, =0.8.0, =1.1.0-rc-1, =1.0.0, =1.142.0, =0.1.5, =1.2.1, =2.0.4, =3.24.1 Source cves: CVE-2026-70603 Source advisory: SNYK:JS-ELECTRON-18563328...

MAL-2026-12417 Malicious code in post-css-transfer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f62ccc235772a34a28d870f349489698c167e3d636a196f310fe24c1ce1d4ef4 post-css-transfer is a typosquat of postcss whose main entry lib/postcss.js has an obfuscated IIFE appended after the legitimate module code. On...

CVE-2026-71279

Zigbee2MQTT's ExternalJSExtension.getFilePath lib/extension/externalJS.ts joins a parameter received via an MQTT message topic zigbee2mqtt/bridge/request/extension/save into the extensions base path using path.joinbasePath, name with no sanitization. The extension handler only validates that the...

CVE-2026-71279 Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution

Zigbee2MQTT's ExternalJSExtension.getFilePath lib/extension/externalJS.ts joins a parameter received via an MQTT message topic zigbee2mqtt/bridge/request/extension/save into the extensions base path using path.joinbasePath, name with no sanitization. The extension handler only validates that the...

CVE-2026-71279 Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution

Zigbee2MQTT's ExternalJSExtension.getFilePath lib/extension/externalJS.ts joins a parameter received via an MQTT message topic zigbee2mqtt/bridge/request/extension/save into the extensions base path using path.joinbasePath, name with no sanitization. The extension handler only validates that the...

MAL-2026-12283 Malicious code in tinkoff-ui-angular-addon-wysiwyg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78e68f5ef666d2dc9c0582121a44516c5b01abcecda034b830e8d13973e16520 The package impersonates a Tinkoff UI Angular addon but ships only a stub class plus a dropper at ext.js that is loaded via index.js on require. On...