MAL-2026-11565 Malicious code in @nebula.js/cli (npm)

npm/@nebula.js/cli is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by t...

Malicious code in @nebula.js/sn-map (npm)

npm/@nebula.js/sn-map is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished b...

MAL-2026-11572 Malicious code in @nebula.js/sn-animator (npm)

npm/@nebula.js/sn-animator is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

CLSA-2026-1784683084 TuxCare security update for js-yaml (1 CVE)

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.14.1-tuxcare.2...

CLSA-2026-1784682988 TuxCare security update for js-yaml (3 CVEs)

TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.14.2-tuxcare.1...

CLSA-2026-1784596292 TuxCare security update for js-yaml (1 CVE)

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 4.1.0-tuxcare.2...

CLSA-2026-1784596307 TuxCare security update for js-yaml (1 CVE)

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.7.0-tuxcare.2...

CLSA-2026-1782781179 TuxCare security update for ua-parser-js (1 CVE)

TuxCare rebuilt ua-parser-js to address 1 CVE. Fixed in 0.7.31-tuxcare.1...

CLSA-2026-1782089812 TuxCare security update for js-cookie (1 CVE)

TuxCare rebuilt js-cookie to address 1 CVE. Fixed in 2.2.1-tuxcare.1...

CLSA-2026-1781484837 TuxCare security update for js-yaml (3 CVEs)

TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.14.1-tuxcare.1...

CLSA-2026-1776904632 TuxCare security update for uglify-js (2 CVEs)

TuxCare rebuilt uglify-js to address 2 CVEs. Fixed in 3.4.10-tuxcare.1...

CLSA-2026-1776904629 TuxCare security update for uglify-js (2 CVEs)

TuxCare rebuilt uglify-js to address 2 CVEs. Fixed in 2.8.29-tuxcare.1...

CLSA-2026-1774570935 TuxCare security update for js-yaml (5 CVEs)

TuxCare rebuilt js-yaml to address 5 CVEs. Fixed in 3.7.0-tuxcare.1...

CLSA-2026-1774225182 TuxCare security update for uglify-js (2 CVEs)

TuxCare rebuilt uglify-js to address 2 CVEs. Fixed in 2.3.6-tuxcare.1...

CLSA-2026-1774311649 TuxCare security update for ua-parser-js (3 CVEs)

TuxCare rebuilt ua-parser-js to address 3 CVEs. Fixed in 0.7.21-tuxcare.1...

CLSA-2026-1773965915 TuxCare security update for js-yaml (3 CVEs)

TuxCare rebuilt js-yaml to address 3 CVEs. Fixed in 3.3.1-tuxcare.1...

CLSA-2026-1773274555 TuxCare security update for uglify-js (2 CVEs)

TuxCare rebuilt uglify-js to address 2 CVEs. Fixed in 1.1.1-tuxcare.1...

EUVD-2026-52561

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset directly, bypassing the...

CVE-2026-58044

A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible IncomingMessage headers while piping the original body to a reused backend connection. Node.js can omit headers beyond maxHeadersCount /...

Security Bulletin: Multiple Vulnerabilities in IBM API Connect

Summary Multiple vulnerabilities were addressed in IBM API Connect version 10.0.8.11 Vulnerability Details CVEID:CVE-2020-28851 DESCRIPTION: In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. x/text/language is supposed to...