MAL-2026-11751 Malicious code in @ornikar/eslint-config-typescript (npm)

npm/@ornikar/eslint-config-typescript is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...

EUVD-2026-52701

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...

CVE-2026-69251

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...

CVE-2026-69251 Flowise RCE via TypeORM DataSource

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, Flowise record manager and agent memory nodes allowed users to set arbitrary TypeORM DataSource options through the additionalConfig input in...

CVE-2026-69251

Flowise prior to version 3.1.3 is affected by a RCE in the TypeORM DataSource configuration via the additionalConfig input on specific nodes (record managers and agent memory nodes for MySQL, Postgres, SQLite, and MySQL/AgentMemory). The issue allows an authenticated user to inject arbitrary Java...

netty-codec-redis: netty-codec-redis: Denial of Service via crafted Redis payload with deeply nested arrays

A flaw was found in netty-codec-redis. A remote attacker can exploit this vulnerability by sending a specially crafted Redis payload containing deeply nested arrays. This action forces the server to allocate a large number of state objects and collections, leading to memory exhaustion...

MAL-2026-11818 Malicious code in @servicetitan/anvil-icons (npm)

npm/@servicetitan/anvil-icons is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11782 Malicious code in @picsart/gen-ai (npm)

npm/@picsart/gen-ai is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...

MAL-2026-11630 Malicious code in @onereach/si-checkbox (npm)

npm/@onereach/si-checkbox is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

Malicious code in @onereach/channel-transformer (npm)

npm/@onereach/channel-transformer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @servicetitan/design-system (npm)

npm/@servicetitan/design-system is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11725 Malicious code in @or-sdk/settings (npm)

npm/@or-sdk/settings is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...

Malicious code in @servicetitan/forge (npm)

npm/@servicetitan/forge is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...

MAL-2026-11937 Malicious code in @servicetitan/titan-chat-ui-common (npm)

npm/@servicetitan/titan-chat-ui-common is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized...

MAL-2026-11928 Malicious code in @servicetitan/suppress-warnings (npm)

npm/@servicetitan/suppress-warnings is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

PYSEC-2026-3590 Open WebUI: Stored web worker XSS via Pyodide

Title: Same-origin Pyodide code execution allows server-side RCE via a shared chat Summary Open WebUI runs client-side Python Pyodide in a same-origin web worker. Through Pyodide's JavaScript API pyodide.http.pyfetch, or the js module which exposes the page's fetch / XMLHttpRequest executed Pytho...

Open WebUI: Stored web worker XSS via Pyodide

Title: Same-origin Pyodide code execution allows server-side RCE via a shared chat SummaryOpen WebUI runs client-side Python Pyodide in a same-origin web worker. Through Pyodide's JavaScript API pyodide.http.pyfetch, or the js module which exposes the page's fetch / XMLHttpRequest executed Python...

MAL-2026-11523 Malicious code in cache-manager (npm)

npm/cache-manager version 7.2.10 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

MAL-2026-11971 Malicious code in flat-cache (npm)

npm/flat-cache version 6.1.24 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub...

Stored Cross Site Scripting

Mettle SendPortal is vulnerable to stored cross-site scripting. The vulnerability is due to the application's failure to properly sanitize user-supplied input in the content parameter of the /templates endpoint, where an attacker can persistently inject malicious JavaScript code that is executed ...