CVE-2026-67870

In open62541 v1.5.5, the server-side AddReferences implementation contains an incomplete validation flaw for non-local ExpandedNodeId targets. A remote attacker can send a crafted AddReferencesRequest with an empty targetServerUri and a non-zero targetNodeId.serverIndex, causing the target node...

CVE-2026-67864

An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeManagement type-instantiation logic component...

CVE-2026-67871

Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, addressspacebs.c, sopcnodemgthelperinternal.c, and toolkittestserver...

CVE-2026-55997: Cleartext Storage of Sensitive Information

Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on...

PT-2026-68142

Name of the Vulnerable Software and Affected Versions Node-RED affected versions not specified Description The local-filesystem library storage module contains a path traversal flaw in the getLibraryEntry and saveLibraryEntry functions. This issue occurs because the user-supplied path parameter i...

CVE-2026-67864

An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeManagement type-instantiation logic component...

MiracleLinux 8 : nodejs:24 (AXSA:2026-1455:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1455:01 advisory. brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-13149 tar: Node-tar: Denial of Service via malformed...

Malicious code in approval-guardian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71875c984aab2d8335b3efdd1b107d7adbd4c3cbd6309278b6804c8162bdca87 The package presents itself as an on-chain approval scanner but on CLI invocation runs a silent credential harvester. src/index.js scan walks the...

MAL-2026-11996 Malicious code in emulative (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e3cf8666b98672329dbb0916b7ef59eac20bce457de82eb40d85b9712e1b4ca On npm install, the package's preinstall lifecycle hook executes index.js, which collects the installer's hostname, username, home directory path, DN...

Malicious code in simple-date-formatter-util-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e53aca949f6ef9820b220363a2b0c7df91e36f08ded73165dfe9140a004fd693 Package advertises itself as a date formatter utility but ships a malicious postinstall payload. package.json declares a postinstall lifecycle script...

MAL-2026-11994 Malicious code in @zzzgenesis00/web3-provider-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fae571005ccdcdc23e50fbee1eddc31d39355706b7945df3ccbb3096ecaf724b Package impersonates MetaMask's web3-provider-engine author field 'MetaMask', homepage pointing to github.com/MetaMask/web3-provider-engine while...

CVE-2026-58040

A flaw was found in Node.js. An incomplete fix for a previous vulnerability allows the HTTPS Agent to reuse Transport Layer Security TLS sessions, bypassing hostname verification across different identity policies. This could enable an attacker to impersonate a legitimate server, leading to...

MAL-2026-11533 Malicious code in @zzzgenesis00/solana-web3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 433d4c4c3c8984e1fdd1a47623a9d5cf7c464ff9a64ce32846a76f10e3224dce This package impersonates Solana Labs author field 'solana-labs', repository pointing at github.com/solana-labs/solana-web3 under an unrelated scope...

Malicious code in @zzzgenesis00/xrp-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49ad59aa1c004d723d6e24f8113d8f3d45728c0b26fc41531ec00c0f91d2ddef The package impersonates XRPLF's xrp-lib author metadata and homepage point at github.com/XRPLF/xrp-lib while being published under an unrelated scop...

Malicious code in simple-date-formatter-util-6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3c4633742f36d29ca968a2ce71c97cb81e9cb2d2c76738742bb39de671cb115 Package advertises a trivial formatDate utility but ships a malicious npm postinstall hook. The postinstall script launches a backgrounded interactiv...

MAL-2026-11544 Malicious code in simple-date-formatter-util-10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4fc695a31f735a6d7603ba7938ea65bb907620d8bee07dd8f93af372623c4df On npm install, package.json's postinstall hook launches a detached bash reverse shell over /dev/tcp to 124.221.154.135:4444, giving remote interacti...

Malicious code in simple-date-formatter-util-10 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b4fc695a31f735a6d7603ba7938ea65bb907620d8bee07dd8f93af372623c4df On npm install, package.json's postinstall hook launches a detached bash reverse shell over /dev/tcp to 124.221.154.135:4444, giving remote interacti...

Malicious code in discord-vibegrations-api-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e39dfe430611b304685f7a5e9b29ecd1661c5238bd2ed706e485e1d82540cfc6 The package declares a postinstall lifecycle hook postinstall: node postinstall.js that opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes it to...

MAL-2026-11537 Malicious code in discord-vibegrations-api-natives (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9cb64ecc29aa68ec4659bab280f4ffd2c3de889cc966c0974f85b0c488edc603 On npm install, the package's postinstall.js opens a TCP socket to 5.tcp.eu.ngrok.io:15496 and pipes the socket's bytes into the stdin of a spawned s...

MAL-2026-11543 Malicious code in simple-date-formatter-new-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 204253c08cc90b592f9c086ada633879141aee2bdf27e7286007c709f3b866ab Package advertised as a date-formatting utility performs supply-chain attack behavior. package.json declares a postinstall shell one-liner that, on n...