ROOT-APP-NPM-CVE-2022-21681 CVE-2022-21681 in marked - Patched by Root

Root has patched CVE-2022-21681 in the marked package for Root:npm. Multiple fixed versions available...

Updated perl-YAML-Syck packages fix security vulnerabilities

YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syckbase64dec YAML::Syck versions before 1.47...

EUVD-2026-69222

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization...

@noema/mfs (>=0.1.0, <=0.3.0), @storm-software/config-tools (>=1.28.2, <=1.30.2) +1 more potentially affected by unknown CVE via @humanfs/node (>=0.11.0, <=0.16.7)

@humanfs/node NPM version =0.11.0, =0.1.0, =1.28.2, =3.0.0, =3.2.1 Source cves: unknown CVE Source advisory: OSV:GHSA-P498-V437-472G...

GHSA-P498-V437-472G humanfs: Recursive copy follows symlinked files and copies data from outside the source tree

Summary @humanfs/node does not treat symlinks as a separate case during copy operations. A symlink placed inside an attacker-controlled source tree can make copyAll read and copy the contents of any file readable by the process, even when that file is outside the directory being copied. Details T...

@noema/mfs (>=0.1.0, <=0.3.0), @storm-software/config-tools (>=1.28.2, <=1.30.2) +1 more potentially affected by unknown CVE via @humanfs/node (>=0.11.0, <=0.16.7)

@humanfs/node NPM version =0.11.0, =0.1.0, =1.28.2, =3.0.0, =3.2.1 Source cves: unknown CVE Source advisory: GHSA-P498-V437-472G...

Malicious Package

Overview bt2-api-gateway-node-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview arif-sate10-riris is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

ROOT-APP-NPM-CVE-2026-27606 CVE-2026-27606 in rollup - Patched by Root

Root has patched CVE-2026-27606 in the rollup package for Root:npm. Multiple fixed versions available...

SUSE CVE-2026-83614

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart...

CVE-2026-84700 Pika Unauthenticated Replication Access via Internal Protobuf Port

PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...

CVE-2026-84700 Pika Unauthenticated Replication Access via Internal Protobuf Port

PikiwiDB Pika v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 e.g. 11221 when the default client port 9221 is used that does not authenticate incoming requests. Although requirepass is intended to gate replication — a slave presents it as...

PT-2026-84843

Name of the Vulnerable Software and Affected Versions submariner affected versions not specified Description In cert-auth mode, the software builds connection configurations using free-form strings from the Custom Resource Definition CRD without proper validation. A malicious cluster can exploit...

PT-2026-84896

Name of the Vulnerable Software and Affected Versions Unpublished Node Permissions versions 0.0.0 through 1.8.0 Description An incorrect authorization issue allows forceful browsing. The module, which manages permissions per node content type to control access to unpublished content, incorrectly...

Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132

This module creates permissions per node content type to control access to unpublished content. The module has allowed view access for published content, overriding other access mechanisms that might have been in place...

league/commonmark: Denial of service in the SmartPunct and Attributes extensions

Impact Two first-party extensions contain quadratic parsing paths. Both ship with the library but must be explicitly registered on the Environment; neither is included in CommonMarkConverter, GithubFlavoredMarkdownConverter, or GithubFlavoredMarkdownExtension. Applications that do not register...

Exploit for Eval Injection in Langflow

CVE-2025-62593 — Ray Unauthenticated RCE Exploit Overview...

Malicious code in bt2-api-gateway-node-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b [email protected] runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — /.ssh private keys,...

MAL-2026-15813 Malicious code in bt2-api-gateway-node-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e7b3146f31802aabbf0fcf530d3581e85274664be041a9c7ef12dfb3eb1713b [email protected] runs a postinstall-triggered IIFE in index.js that reads installer-owned secrets from disk — /.ssh private keys,...

Allocation of Resources Without Limits or Throttling

Overview @xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom Affected versions of this package are vulnerable to Allocation of...