267463 matches found
Malicious code in @xiaohhhh1/canvas-agent (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a34add291ef7584aec7041449cb2e80d36ae98f93c2725e1aa018707e3334119 On bin start, @xiaohhhh1/canvas-agent opens an outbound WebSocket to the hardcoded relay wss://canvas.xiaohhhh1.com/api/agent-relay and treats inboun...
Malicious code in vitest-preview-pro-all (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ddcab31555f393ab1d7df6ea760094517d20acdf764a27983f19d853783e63a7 package.json postinstall runs lib/utils/index.js, which spawns a detached Node child executing lib/utils/smtp-connection/index.js. That file is heavi...
MAL-2026-13401 Malicious code in helmet-pro (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea17cadddf76a704e98b6c98881f654b13eb16a54d51af5a6b547e36a58d3402 [email protected] is a typosquat of the popular helmet HTTP-header middleware. Its package.json postinstall hook runs lib/utils/index.js, which spawn...
MAL-2026-13391 Malicious code in @zahlen/checkout (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d1a20d08b428711d9b8c349d981cf4997f086b8cbd8dce407ef26e02706f33e No a static rule or traced code paths flagged malicious behavior in this package. No lifecycle hooks fetching or executing remote content, no...
Malicious code in ezdiscordbots (npm)
Source: amazon-inspector a715452291e1bd779802f51dc90eca91740307e0bee7b9e2ca94f6f863f6a921 package.json declares a postinstall script sudo node install.js that runs install.js with root privileges on the installer's machine. Both install.js and index.js are heavily obfuscated js-virtualizer /...
EUVD-2026-53679
Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, addressspacebs.c, sopcnodemgthelperinternal.c, and toolkittestserver...
DEBIAN-CVE-2026-67870
In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node...
CVE-2026-67870
In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node...
CVE-2026-67871
Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, addressspacebs.c, sopcnodemgthelperinternal.c, and toolkittestserver...
CVE-2026-71498: Out-of-bounds Read
node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated incomplete multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while attempting to decode the final,...
RHEL 9 : glib2 (RHSA-2026:51177)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:51177 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, th...
PT-2026-68947
Description WrappedRE2::Replace builds the replacement result and hands it to V8 with .ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the string/buffer exceeds its maximum length: lib/replace.cc v1.24.1: cpp // L553 — Buffer return path...
📄 Node-RED 5.0.4 Unauthenticated Denial of Service
A proof of concept exploit for an unauthenticated denial of service vulnerability in Node-RED version 5.0.4. The vulnerability is triggered by a path traversal primitive that allows a bare .. segment to reach the library save path, ultimately causing an unhandled promise rejection and process...
CVE-2026-71430: Reachable Assertion
node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the resulting string or buffer exceeds V8's...
AlmaLinux 9 : nodejs:22 (ALSA-2026:47058)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:47058 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed tar...
PT-2026-68800
Description WrappedRE2::Replace builds the replacement result and hands it to V8 with .ToLocalChecked without checking for the empty MaybeLocal that V8 returns when the string/buffer exceeds its maximum length: lib/replace.cc v1.24.1: cpp // L553 — Buffer return path...
PT-2026-68815
Name of the Vulnerable Software and Affected Versions node-re2 versions prior to 1.26.1 Description An out-of-bounds read exists when passing a Buffer whose final bytes form a truncated multi-byte UTF-8 sequence. The native binding fails to validate the remaining buffer size when decoding the fin...
MAL-2026-13383 Malicious code in svelte-mapped-metrics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 666d747ec06fa428dfb0f21867e6001b52450fee1770061dcd9bd0ec9e3731fa [email protected] shows no evidence of credential access, install-time or import-time code execution from remote sources, silent relay of...
Malicious code in svelte-mapped-metrics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 666d747ec06fa428dfb0f21867e6001b52450fee1770061dcd9bd0ec9e3731fa [email protected] shows no evidence of credential access, install-time or import-time code execution from remote sources, silent relay of...