Malicious Package

Overview alf-ui-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

OESA-2026-1170 nodejs-js-yaml security update

This is an implementation of YAML YAML Ain't Markup Language, a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec. Security Fixes: js-yaml is a JavaScript YAML parser and dumper. In js-ya...

OESA-2026-1168 nodejs-js-yaml security update

This is an implementation of YAML YAML Ain't Markup Language, a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec. Security Fixes: js-yaml is a JavaScript YAML parser and dumper. In js-ya...

OESA-2026-1171 nodejs-js-yaml security update

This is an implementation of YAML YAML Ain't Markup Language, a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec. Security Fixes: js-yaml is a JavaScript YAML parser and dumper. In js-ya...

OESA-2026-1169 nodejs-js-yaml security update

This is an implementation of YAML YAML Ain't Markup Language, a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec. Security Fixes: js-yaml is a JavaScript YAML parser and dumper. In js-ya...

OESA-2026-1166 nodejs-js-yaml security update

This is an implementation of YAML YAML Ain't Markup Language, a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec. Security Fixes: js-yaml is a JavaScript YAML parser and dumper. In js-ya...

OESA-2026-1167 nodejs-js-yaml security update

This is an implementation of YAML YAML Ain't Markup Language, a human friendly data serialization language. It started as PyYAML port, and was completely rewritten from scratch. Now it's very fast, and supports the 1.2 spec. Security Fixes: js-yaml is a JavaScript YAML parser and dumper. In js-ya...

Malicious code in js-observability (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec70afb236a90dfd2de166a3fe7626fc3c10526de7dffda8468c0a8eccaf964b The package js-observability was found to contain malicious code. Source: ghsa-malware e73e93c1fefbabe1cd40c1fafdb7cd01b97aae241106ecee4aad599c02756d...

EUVD-2026-3069

Malicious code in js-observability npm...

Malicious code in alf-ui-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e921c338478d9d9b6dd8bcf6413b03594cac2e53ac71b26a059488ee0833a9d8 The package alf-ui-js was found to contain malicious code. Source: ghsa-malware 32056719006c9565534074da200f7147ab2f96db963b372e3cf8e1e362d20ea3 Any...

EUVD-2026-3088

Malicious code in alf-ui-js npm...

MAL-2026-267 Malicious code in alf-ui-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e921c338478d9d9b6dd8bcf6413b03594cac2e53ac71b26a059488ee0833a9d8 The package alf-ui-js was found to contain malicious code. Source: ghsa-malware 32056719006c9565534074da200f7147ab2f96db963b372e3cf8e1e362d20ea3 Any...

MAL-2026-289 Malicious code in js-observability (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec70afb236a90dfd2de166a3fe7626fc3c10526de7dffda8468c0a8eccaf964b The package js-observability was found to contain malicious code. Source: ghsa-malware e73e93c1fefbabe1cd40c1fafdb7cd01b97aae241106ecee4aad599c02756d...

io.vertx:vertx-hazelcast (2.1m2), io.vertx:vertx-platform (2.1m2) +5 more potentially affected by CVE-2026-1002 via io.vertx:vertx-core (2.1m2)

io.vertx:vertx-core MAVEN version 2.1m2 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-core and may be impacted: - io.vertx:vertx-hazelcast 2.1m2 - io.vertx:vertx-platform 2.1m2 - net.kuujo:vertigo 0.6.2 - net.kuujo:vertigo-js 0.6.2 -...

com.ecfront:ez-rpc (>=2.1.0, <=2.2.0), io.vertx:vertx-codetrans (3.0.0-dev_preview1) +14 more potentially affected by CVE-2026-1002 via io.vertx:vertx-core (3.0.0-dev_preview1)

io.vertx:vertx-core MAVEN version 3.0.0-devpreview1 is affected by a known vulnerability. The following packages have a transitive dependency on io.vertx:vertx-core and may be impacted: - com.ecfront:ez-rpc =2.1.0, =2.2.0 - io.vertx:vertx-codetrans 3.0.0-devpreview1 - io.vertx:vertx-ext-parent...

Security Bulletin: A security vulnerability in WebSphere Liberty affects IBM Robotic Process Automation for Cloud Pak (CVE-2020-36732).

Summary A security vulnerability in WebSphere Liberty affects IBM Robotic Process Automation for Cloud Pak. WebSphere Application Liberty is used by IBM Robotic Process Automation as part of Antivirus and Abbyy containers as well as UMS. This bulletin identifies the fixes required to address this...

Linux Distros Unpatched Vulnerability : CVE-2026-21636

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js's permission model allows Unix Domain Socket UDS connections to bypass network restrictions when --permission is enabled. Even without...

Linux Distros Unpatched Vulnerability : CVE-2025-55130

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw in Node.js's Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By...

Linux Distros Unpatched Vulnerability : CVE-2025-59465

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data can cause Node.js to crash by triggering an unhandled TLSSocket error ECONNRESET. Instead of...

CVE-2022-50932

Kyocera Command Center RX ECOSYS M2035dn contains a directory traversal vulnerability that allows unauthenticated attackers to read sensitive system files by manipulating file paths under the /js/ path. Attackers can exploit the issue by sending requests like /js/../../../../.../etc/passwd%00.jpg...