Malicious code in cluster-auth0-json-dotenv-safe (npm)

Source: amazon-inspector 772c519c283df8f248742b2b97fa33752794ca5101efa6cf8fc76a445d26e100 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in chromedriver-json-polaris-hyperion (npm)

Source: amazon-inspector 7ef32861229671cc069a228322d0a6b1db62d689ae18e79f73f60ba5d10f87ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in charon-json-typeorm-nightwatch (npm)

Source: amazon-inspector 3ecd5ce8d359b222563a4c16211f8831bc0ae6bc589d8fe9da56a084f89f1493 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in chariklo-socketio-json-readable (npm)

Source: amazon-inspector 6a2777a71a408df661dc26029a35d31cc970041c51b3816927289ddc328f01cd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in centaurus-backend-json-draco (npm)

Source: amazon-inspector bb8dea9b73b571b9c8d8e272ee880a099ecc1292ae7297f81817f14529e4d3b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

OpenCPU RCE via do.call

Exploits unauthenticated R code execution on OpenCPU via /ocpu/library/base/R/do.call/json with systempaste.... Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """OpenCPU R do.call system RCE — execute session.""" from future import annotations import json import r...

Malicious Package

Overview json-into-html is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @yoannchb/wtf-json is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2026-71452

An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows any remote authenticated user, including users with the low-privileged Standard role, to retrieve the configured OPC-UA authentication credentia...

PT-2026-85472

Name of the Vulnerable Software and Affected Versions fastify versions prior to 5.12.2 Description An issue exists in how HTTP header names are handled during the compilation of a route's header schema. The software attempts to implement the case-insensitive nature of HTTP headers by lowercasing...

Linux Distros Unpatched Vulnerability : CVE-2026-84963

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-106200)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106200 advisory. Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: JSON. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10...

Linux Distros Unpatched Vulnerability : CVE-2026-84969

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a heap buffer when a...

CVE-2026-84469: Improper Input Validation

fastify versions before 5.12.2 decide whether to compile a request schema based on JavaScript truthiness, but JSON Schema Draft 7 defines the boolean false as a valid schema that rejects every instance. When an application assigns false to a route's body, querystring, params, or headers schema to...

CVE-2026-75162

An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows any remote authenticated user, including users with the low-privileged Standard role, to retrieve the configured OPC-UA authentication credentia...

PT-2026-91808

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi json string escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that...

CVE-2026-84961: Improper Certificate Validation

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

PT-2026-85804

Name of the Vulnerable Software and Affected Versions undici versions 7.24.1 through 7.29.0 undici versions 8.0.0 through 8.10.1 Description The BalancedPool constructor uses an internal deep-clone process that serializes and reparses the options object as JSON. Since JSON does not support...

CVE-2026-84961: Improper Certificate Validation

undici's BalancedPool constructor passes its entire options object through an internal deep-clone that serializes and reparses the value as JSON. Because JSON cannot represent functions, any function-valued TLS option, such as a caller-supplied checkServerIdentity callback or a custom connector...

Linux Distros Unpatched Vulnerability : CVE-2026-84965

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operati...