256550 matches found
GHSA-XQ3M-2V4X-88GG vulnerabilities
Vulnerabilities for packages: nemo, kubeflow-centraldashboard, kibana, pulumi, langfuse, vitess, gemini-cli, jitsucom-jitsu, librechat, opentelemetry-auto-instrumentations-node, langfuse-fips, renovate...
GHSA-29X4-R6JV-FF4W Zebra Vulnerable to Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients
A vulnerability in Zebra's JSON-RPC HTTP middleware allows an authenticated RPC client to cause a Zebra node to crash by disconnecting before the request body is fully received. The node treats the failure to read the HTTP request body as an unrecoverable error and aborts the process instead of...
Zebra has rk Identity Point Panic in Transaction Verification
rk Identity Point Panic in Transaction Verification Summary Orchard transactions contain a rk field which is a randomized validating key and also an elliptic curve point. The Zcash specification allows the field to be the identity a "zero" value, however, the orchard crate which is used to verify...
PT-2026-37131
A vulnerability in Zebra's JSON-RPC HTTP middleware allows an authenticated RPC client to cause a Zebra node to crash by disconnecting before the request body is fully received. The node treats the failure to read the HTTP request body as an unrecoverable error and aborts the process instead of...
Remote Code Execution (RCE) via String Literal Injection into math-codegen
Impact String literal content passed to cg.parse is injected verbatim into a new Function body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the parser. Any application exposing a math evaluation endpoint where user input flo...
GHSA-P6X5-P4XF-CC4R Remote Code Execution (RCE) via String Literal Injection into math-codegen
Impact String literal content passed to cg.parse is injected verbatim into a new Function body without sanitization. This allows an attacker to execute arbitrary system commands when user-controlled input reaches the parser. Any application exposing a math evaluation endpoint where user input flo...
GHSA-736R-JWJ6-4W23 OpenClaw: Sandboxed agents could escape exec routing via host=node override
Summary Sandboxed agents could escape exec routing via host=node override. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.5 = 2026.4.10 Impact A sandboxed agent could request host: "node" and route exec to a remote node instead of the intended...
OpenClaw: Sandboxed agents could escape exec routing via host=node override
Summary Sandboxed agents could escape exec routing via host=node override. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.5 = 2026.4.10 Impact A sandboxed agent could request host: "node" and route exec to a remote node instead of the intended...
OpenClaw: Workspace provider auth choices could auto-enable untrusted provider plugins
Summary Workspace provider auth choices could auto-enable untrusted provider plugins. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.9 Impact Non-interactive onboarding could select a provider auth choice shadowed by an untrusted workspace plugin,...
OpenClaw: Empty approver lists could grant explicit approval authorization
Summary Empty approver lists could grant explicit approval authorization. Affected Packages / Versions - Package: openclaw - Ecosystem: npm - Affected versions: = 2026.4.12 Impact For helper-backed channels, an empty resolved approver list could be interpreted as explicit approval authorization,...
Complete Bypass of CVE-2026-24884 Patch via Git-Delivered Symlink Poisoning in compressing
Executive Summary This report documents a critical security research finding in the compressing npm package specifically tested on the latest v2.1.0. The core vulnerability is a Partial Fix Bypass of CVE-2026-24884. The current patch relies on a purely logical string validation within the...
MAL-2026-2926 Malicious code in material-ui-plugin-cache-endpoint (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45efd49ad74d002b46224881218cf53c763e58c0b71ed3d3ff3a79d1021f3a64 The package material-ui-plugin-cache-endpoint was found to contain malicious code. Source: ghsa-malware...
Malicious code in material-ui-plugin-cache-endpoint (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45efd49ad74d002b46224881218cf53c763e58c0b71ed3d3ff3a79d1021f3a64 The package material-ui-plugin-cache-endpoint was found to contain malicious code. Source: ghsa-malware...
GHSA-PC3F-X583-G7J2 vulnerabilities
Vulnerabilities for packages: kargo, argocd-image-updater, dynamic-localpv-provisioner, cilium-cli, k8ssandra-client, percona-server-mongodb-operator, infinispan-operator, eksctl, kiali, sonobuoy, skaffold, gitlab-runner, k8sgpt, cloudnative-pg, argo-rollouts, kubernetes, kubevela, envoy-gateway,...
CVE-2026-35469 vulnerabilities
Vulnerabilities for packages: kargo, argocd-image-updater, dynamic-localpv-provisioner, cilium-cli, k8ssandra-client, percona-server-mongodb-operator, infinispan-operator, eksctl, kiali, sonobuoy, skaffold, gitlab-runner, k8sgpt, cloudnative-pg, argo-rollouts, kubernetes, kubevela, envoy-gateway,...
Malicious code in value-slider (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abf877173b9292185a66f77e03a35a1964c716f9cc053cd68cfd66fa005843fa The package value-slider was found to contain malicious code. Source: ghsa-malware cf716f2e826f45d1313d19d4691315d634d3199be557367c4346af4481aec65c A...
Malicious Package
Overview @than-xs/libsignal-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...
MAL-2026-2848 Malicious code in @than-xs/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c613873d188e4ec1b5e30520478eb5e162c8f2b10cad3dd50e0973d9ca925034 The package @than-xs/libsignal-node was found to contain malicious code. Source: ghsa-malware...
Malicious Package
Overview node-red-contrib-yolo-object-detection is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...
Malicious code in node-red-contrib-yolo-object-detection (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f37c68b0e146f969ed875753302026894ce41d379d736a1856b9e12a8c1a4479 The package node-red-contrib-yolo-object-detection was found to contain malicious code. Source: ghsa-malware...