Malicious Package

Overview @vnxsync/libsignal-node is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the...

PT-2026-89566

Name of the Vulnerable Software and Affected Versions Consul versions prior to 2.0.4 Consul Enterprise versions prior to 1.21.18 Consul Enterprise versions prior to 1.22.12 Consul Enterprise versions prior to 2.0.4 Description An authorization bypass exists in the catalog node-write path. An...

CVE-2026-87090: Incorrect Authorization

Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attacker to delete another node's catalog registration and take over its node identity. An attacker with a token granting node-write permission on any single node...

hugo: Hugo: Arbitrary file read/write via unrestricted file system access in Node-based asset pipelines

A flaw was found in Hugo. When building a Hugo site that uses Node-based asset pipelines such as PostCSS, Babel, or TailwindCSS, Hugo invoked the configured Node tools without restrictions on file system access. This could allow code running through these tools to read or write files outside the...

Malicious code in mfatest2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dea6c92bd37f4ff11dfa24ad1415d1a01351ee62baf37718a7c10362d393c15 package.json declares its only runtime dependency as an unpinned GitHub ref "node-net-pool": "github:trktgq0wbre1/node-net-pool" pointing at a...

MAL-2026-16102 Malicious code in mfatest2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dea6c92bd37f4ff11dfa24ad1415d1a01351ee62baf37718a7c10362d393c15 package.json declares its only runtime dependency as an unpinned GitHub ref "node-net-pool": "github:trktgq0wbre1/node-net-pool" pointing at a...

MAL-2026-16100 Malicious code in discord-mfa-solver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e On require of the package, lib/cache.js reached from index.js executes trymodule'require'catch — a bracket-notation, error-swallowed dynamic require ...

Malicious code in discord-mfa-solver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e On require of the package, lib/cache.js reached from index.js executes trymodule'require'catch — a bracket-notation, error-swallowed dynamic require ...

DRUPAL-CONTRIB-2026-140

This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability XSS. This vulnerability is...

Malicious code in @vnxsync/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c34a09a0ca8e45d167ab7b26e0b1882a8e2cabffc64495637e884258b3ea57ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16083 Malicious code in @vnxsync/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c34a09a0ca8e45d167ab7b26e0b1882a8e2cabffc64495637e884258b3ea57ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Prototype Pollution

node-csv is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of duplicate proto CSV headers when columns and groupcolumnsbyname are enabled, which allows an attacker to inject an attacker-controlled array into the parsed record's prototype and manipulate inherited...

renode v1.17.0

Renode Copyright c 2010-2026 Antmicro What is Renode? Renode was created by Antmicro as a virtual development tool for multi-node embedded networks both wired and wireless and is intended to enable a scalable workflow for creating effective, tested and secure IoT systems. With Renode, developing,...

SUSE CVE-2026-55678

Arc is an open, SQL-native time-series database for telemetry. From 26.02.1 until 26.06.2, Arc Enterprise clustering accepts cluster join requests without authentication when cluster.enabled is true but cluster.sharedsecret is not configured. The defaults in internal/config/config.go set...

Quantifying IIoT Sensor Node Criticality by Fusing Its Data Criticality and Security Vulnerability

The integration of the Industrial Internet of Things IIoT into manufacturing has transformed industrial operations by optimising production management and ensuring product quality through smart industrial sensors that regulate processes based on real-time data. However, these sensor nodes are...

PT-2026-89241

Name of the Vulnerable Software and Affected Versions Drupal SafeDelete versions 0.0.0 through 1.0.88 Description Stored cross-site scripting XSS occurs because the module does not sufficiently sanitize node titles when displaying the orphaned nodes report. This allows an attacker with permission...

SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140

This module enables you to manage content deletion and provides reports for identifying orphaned content. The module doesn't sufficiently sanitize node titles when displaying the orphaned nodes report. This leads to a persistent cross-site scripting vulnerability XSS. This vulnerability is...

Elasticsearch 8.x < 8.19.20 / 9.0.x < 9.3.0 DoS (ESA-2026-47)

The version of Elasticsearch installed on the remote host is 8.x prior to 8.19.20, or 9.0.x prior to 9.3.0. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-47 advisory. - Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to a denial...

CVE-2026-63376

A flaw was found in toml-node, a software library used for parsing TOML Tom's Obvious, Minimal Language files in Node.js and web applications. A remote attacker could exploit a vulnerability known as prototype pollution by providing specially crafted TOML input. This could allow the attacker to...

CVE-2026-77465

A flaw was found in toml-node. A remote, unauthenticated attacker can exploit an uncontrolled recursion vulnerability in the TOML parser by crafting a malicious TOML document with deeply nested arrays or inline tables. This can lead to the exhaustion of the Node.js call stack, causing a RangeErro...