255372 matches found
MAL-2026-10979 Malicious code in @apexfdn/apex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dbc2117528ff8a612341edb673a46c0ced3745bccf0c4c60f3b7cdf86d501af3 On npm install, install.js runs as a postinstall step and downloads a platform-specific executable from...
Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint
Summary An unbounded io.ReadAllctx.Req.Body call in the NPM package tag API endpoint allows any authenticated user to crash the Gitea server by sending a single large HTTP request. The request body is read entirely into memory with no size limit, causing an Out-of-Memory OOM kill. With concurrent...
CVE-2026-59141
Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdxfindlocked. The attach-time validator rdxvalidateheader checks the header scalars and region layout against the file size, but does not validate the node records it then...
GHSA-VCRF-J523-4MRF aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling
Summary AWS CDK aws-cdk-lib is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS command injection issue in the NodejsFunction Docker bundling pipeline in aws-cdk-lib before 2.260.0 that might allow an actor who controls dependen...
CVE-2026-59141 Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx_find_locked
Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdxfindlocked. The attach-time validator rdxvalidateheader checks the header scalars and region layout against the file size, but does not validate the node records it then...
CVE-2026-59141
Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdxfindlocked. The attach-time validator rdxvalidateheader checks the header scalars and region layout against the file size, but does not validate the node records it then...
CVE-2026-59140
Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths. The attach-time validator ssvalidateheader bounds only the root index against the node pool nodecapacity. The order-statistics and min/max queries th...
CVE-2026-59140
CVE-2026-59140 affects Data::SortedSet::Shared
EUVD-2026-42315
Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set...
Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
The same as the hono core Path traversal in serve-static on Windows via encoded backslash %5C. Summary On Windows hosts, an encoded backslash %5C in the request path decodes to , which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as...
GHSA-FRVP-7C67-39W9 Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)
The same as the hono core Path traversal in serve-static on Windows via encoded backslash %5C. Summary On Windows hosts, an encoded backslash %5C in the request path decodes to , which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as...
MAL-2026-10984 Malicious code in veskra (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f85333fa48c61a31c9f7be395bdc5ef70596e317a3bc9124f67ece4ffcf96901 [email protected] contains six files with no static or behavioral indicators of supply-chain attack: no lifecycle scripts fetching remote content, no...
MAL-2026-10980 Malicious code in nolby (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...
OPENSUSE-SU-2026:21399-1 Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions
This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions fixes the following issues: Security issues fixed: - CVE-2025-13465: lodash: prototype pollution in the .unset and .omit functions can lead to deletion of methods from global prototyp...
GHSA-W8WR-V893-VJVP vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, gitlab-rails-ce-fips, prism, lerna, sqlpad, gitlab-rails-ce, kibana, opensearch-dashboards, homepage, wazuh-dashboard-fips, code-server, graalvm, saf, kubeflow-centraldashboard, pulumi, actions-runner, npm, opensearch-dashboards-fips...
GHSA-8X88-C5MF-7J5W vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, gitlab-rails-ce-fips, prism, lerna, sqlpad, gitlab-rails-ce, kibana, opensearch-dashboards, homepage, wazuh-dashboard-fips, code-server, graalvm, saf, kubeflow-centraldashboard, pulumi, actions-runner, npm, opensearch-dashboards-fips...
GHSA-23HP-3JRH-7FPW vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, gitlab-rails-ce-fips, prism, lerna, sqlpad, gitlab-rails-ce, kibana, opensearch-dashboards, homepage, wazuh-dashboard-fips, code-server, graalvm, saf, kubeflow-centraldashboard, pulumi, actions-runner, npm, opensearch-dashboards-fips...
GHSA-GVWX-54WH-QM9J vulnerabilities
Vulnerabilities for packages: wazuh-dashboard, gitlab-rails-ce-fips, prism, lerna, sqlpad, gitlab-rails-ce, kibana, opensearch-dashboards, wazuh-dashboard-fips, code-server, graalvm, saf, kubeflow-centraldashboard, pulumi, actions-runner, npm, opensearch-dashboards-fips...
