ROOT-APP-NPM-CVE-2026-43998 CVE-2026-43998 in vm2 - Patched by Root

Root has patched CVE-2026-43998 in the vm2 package for Root:npm. Multiple fixed versions available...

@corexium/xbails (0.0.7), @synergyxd/baileys (0.0.3) potentially affected by unknown CVE via @bellaxchuu/libsignal-node (0.0.1-security)

@bellaxchuu/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @bellaxchuu/libsignal-node and may be impacted: - @corexium/xbails 0.0.7 - @synergyxd/baileys 0.0.3 Source cves: unknown CVE Source advisory:...

Malicious Package

Overview node-fetch-lite is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview node-env-resolve is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview node-gyp-runtime is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @bellaxchuu/libsignal-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @xayz/libsignal-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-106510

A flaw was found in plugin-techdocs-node. An authenticated attacker with permissions to register catalog entities can achieve arbitrary code execution by submitting a crafted documentation configuration file. When the documentation is built, the malicious markdown extensions setting triggers...

CVE-2026-106556

A flaw was found in the Backstage plugin-techdocs-node component. Insufficient validation of documentation configuration files during documentation generation allows sanitization checks to be bypassed. An authenticated user with permission to register or modify documentation sources can exploit...

ROOT-APP-NPM-CVE-2026-31938 CVE-2026-31938 in jspdf - Patched by Root

Root has patched CVE-2026-31938 in the jspdf package for Root:npm. Multiple fixed versions available...

MAL-2026-17663 Malicious code in mfasolver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f583d18816b977d3e721da8423405533e9915ad13631d8114e40e54aefd9152 package.json at line 41 declares the only runtime dependency node-net-pool as...

Malicious code in mfasolver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f583d18816b977d3e721da8423405533e9915ad13631d8114e40e54aefd9152 package.json at line 41 declares the only runtime dependency node-net-pool as...

Malicious code in hardhat-deep (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fde0a4a0ec197ee1aab9acf20ea157268b553fdb5669c545c27d92cbf89fe304 The npm package [email protected] is a trojanised shell. Its tarball copies the pino logger source tree README, SECURITY.md, index.d.ts, lib/proto.j...

CLEANSTART-2026-CA85404 undici's experimental WebSocketStream client crashes the whole Node

CVE-2026-85014 affects multiple packages. undici's experimental WebSocketStream client crashes the whole Node. See references for individual vulnerability details...

CLEANSTART-2026-CK85673 undici's WebSocket client crashes the whole Node

CVE-2026-19534 affects multiple packages. undici's WebSocket client crashes the whole Node. See references for individual vulnerability details...

CLEANSTART-2026-YB63066 fast-uri is a URI parser for Node

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

CLEANSTART-2026-NC17726 fast-uri is a URI parser for Node

Security vulnerability affects the langfuse package. fast-uri is a URI parser for Node...

CLEANSTART-2026-LJ34730 node-csv is a full-featured CSV parser with a simple API that is tested against large datasets

Security vulnerability affects the langfuse-worker package. node-csv is a full-featured CSV parser with a simple API that is tested against large datasets...

CLEANSTART-2026-KW79982 Security fix for GHSA-259r-337f-4rfw applied in: aws-network-policy-agent 1.1.6-r4, caddy 2.11.4-r1, fabric-peer 2.5.16-r2, fabric-peer 3.1.5-r1, gotenberg 8.33.0-r0, kubernetes-dns-node-cache 1.23.1-r2, step 0.30.2-r4

GHSA-259r-337f-4rfw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CVE-2026-89091: Improper Link Resolution Before File Access

A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...