AZL-92075 CVE-2026-45822 affecting package js-jquery 3.5.0-4

decode-uri-component through 0.4.1 is vulnerable to denial of service. The decode function splits input on '%' producing N tokens and calls decodeComponents, exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately...

OPENSUSE-SU-2026:21176-1 Security update for python-pytest-html

This update for python-pytest-html fixes the following issues: Changes in python-pytest-html: - Revendor updating shell-quote and js-yaml deps: - CVE-2026-13311: shell-quote: inefficient input parsing can lead to a denial of service bsc1269361 - CVE-2026-53550: js-yaml: quadratic complexity when...

CVE-2026-46625

A flaw was found in JavaScript Cookie js-cookie. This vulnerability allows a remote attacker to manipulate cookie attributes by exploiting a prototype pollution issue within the assign helper function. When processing specially crafted JSON input, the flaw enables an attacker to hijack the...

Malicious Package

Overview unleash-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-6664 Malicious code in hrb-cas-auth-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccfa589a59f63f85fca72ce4582bfa37b0b480078b00627f1e1612e0a7d8d5d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hrb-cas-auth-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccfa589a59f63f85fca72ce4582bfa37b0b480078b00627f1e1612e0a7d8d5d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PraisonAI Vulnerable to Remote Code Execution via YAML Deserialization in Agent Definition Loading

SummaryThe AgentService.loadAgentFromFile method uses the js-yaml library to parse YAML files without disabling dangerous tags such as !!js/function and !!js/undefined. This allows an attacker to craft a malicious YAML file that, when parsed, executes arbitrary JavaScript code. An attacker can...

Malicious code in ryan-pdf-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3d966501b5f533318c26b54887cd29b3cd6c9495035a0f74519ba349357e3eb [email protected] is an empty stub package index.js exports whose sole purpose is to deliver an off-registry payload at install time. Its package.js...

CVE-2026-50029

creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:39+00:00| published-proof-of-concept| https://github.com/sunnyadn/js-toml/security/advisories/GHSA-m34p-749j-x6m6...

barrelly (>=1.0.0, <=1.2.0), rsbuild-plugin-wasmpack (>=0.0.4, <=2.0.0) potentially affected by CVE-2026-50029 via js-toml (>=1.0.0, <=1.1.0)

js-toml NPM version =1.0.0, =1.0.0, =0.0.4, =2.0.0 Source cves: CVE-2026-50029 Source advisory: SNYK:JS-JSTOML-17728417...

barrelly (>=1.0.0, <=1.2.0), rsbuild-plugin-wasmpack (>=0.0.4, <=2.0.0) potentially affected by CVE-2026-50029 via js-toml (>=1.0.0, <=1.1.0)

js-toml NPM version =1.0.0, =1.0.0, =0.0.4, =2.0.0 Source cves: CVE-2026-50029 Source advisory: OSV:GHSA-M34P-749J-X6M6...

CVE-2026-48619

A flaw was found in Node.js. A malicious server can exploit the HTTP/2 client by sending an unlimited number of ORIGIN frames. This can lead to an Out of Memory error on the client, resulting in a denial of service. Mitigation Mitigation for this issue is either not available or the currently...

NPM: js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals

NPM: js-toml vulnerable to CPU exhaustion via On^2 BigInt construction on radix-prefixed integer literals vulnerability discovered by ? in WordPress Npm js-toml versions = 1.1.0...

js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals

Summary js-toml versions up to and including 1.1.0 parse hexadecimal / octal / binary integer literals via a hand-written parseBigInt loop that multiplies a BigInt accumulator by the radix once per input digit. Each iteration performs a BigInt BigInt operation on an accumulator that grows linearl...

barrelly (>=1.0.0, <=1.2.0), rsbuild-plugin-wasmpack (>=0.0.4, <=2.0.0) potentially affected by CVE-2026-49293 via js-toml (>=1.0.0, <=1.1.0)

js-toml NPM version =1.0.0, =1.0.0, =0.0.4, =2.0.0 Source cves: CVE-2026-49293 Source advisory: SNYK:JS-JSTOML-17728419...

barrelly (>=1.0.0, <=1.2.0), rsbuild-plugin-wasmpack (>=0.0.4, <=2.0.0) potentially affected by CVE-2026-49293 via js-toml (>=1.0.0, <=1.1.0)

js-toml NPM version =1.0.0, =1.0.0, =0.0.4, =2.0.0 Source cves: CVE-2026-49293 Source advisory: OSV:GHSA-WP3C-266W-4QFQ...

GHSA-WP3C-266W-4QFQ js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals

Summary js-toml versions up to and including 1.1.0 parse hexadecimal / octal / binary integer literals via a hand-written parseBigInt loop that multiplies a BigInt accumulator by the radix once per input digit. Each iteration performs a BigInt BigInt operation on an accumulator that grows linearl...

Malicious code in db-plog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 961a6a108104105727b81399e6a3a6d56636cb79ae8fbfbbc33528f90d890d99 On every Model instantiation — the package's documented primary API — dist/index.js executes execSync'npm install db-connector-log --no-warnings...

CVE-2026-57652 WordPress JS Help Desk plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability

Unauthenticated Insecure Direct Object References IDOR in JS Help Desk = 3.1.0 versions...

WordPress JS Help Desk plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by William Matos in WordPress Plugin JS Help Desk versions = 3.1.0...