MAL-2026-2770 Malicious code in helios-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector abeb968ba4df2b2034b9794205c8251dd5687f652448abd156fafb7f117fbc6e The package helios-components was found to contain malicious code...

MAL-2026-2703 Malicious code in @3stripes/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31ba4725ff03b9b0a4645734fca9af46fbd145e147f7fb7ee0942853c425f53f The package @3stripes/components was found to contain malicious code...

Malicious code in @3stripes/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31ba4725ff03b9b0a4645734fca9af46fbd145e147f7fb7ee0942853c425f53f The package @3stripes/components was found to contain malicious code...

com.codbex.atlas:codbex-atlas-application (>=2.111.0, <=14.90.0), com.codbex.hades:codbex-hades-application (>=2.81.0, <=14.62.0) +13 more potentially affected by CVE-2026-41240 via org.webjars.npm:dompurify (>=3.1.7, <=3.3.0)

org.webjars.npm:dompurify MAVEN version =3.1.7, =2.111.0, =2.81.0, =2.80.0, =2.73.0, =2.72.0, =1.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =0.54.0, =0.55.1 Source cves: CVE-2026-41240 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16078388...

@reldens/server-utils (0.48.0), @sap-ux/ui-components (>=2.1.4, <=2.1.10) +11 more potentially affected by CVE-2026-40186 via sanitize-html (2.17.2)

sanitize-html NPM version 2.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on sanitize-html and may be impacted: - @reldens/server-utils 0.48.0 - @sap-ux/ui-components =2.1.4, =0.6.17, =0.3.16, =0.1.32, =0.0.31, =0.30.19, =1.0.0-alpha.5, =0.19.3,...

CVE-2026-32162

Acceptance of extraneous untrusted data with trusted data in Windows COM allows an unauthorized attacker to elevate privileges locally...

CVE-2026-35469

A flaw was found in the SPDY streaming code used by Kubelet, CRI-O, and kube-apiserver. An attacker with specific cluster roles, such as those allowing access to pod port forwarding, execution, or attachment, or node proxying, could exploit this vulnerability. This could lead to a Denial of Servi...

Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring and Dashboard operands are vulnerable to denial of service (CVE-2026-0994)

Summary Python module protobuf is used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container DesignerAuthoring and Dashboard operands are vulnerable to denial of service. This bulletin provides patch information to address the reported vulnerability in...

Malicious code in @athena-ui-components/axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec575fc86c9df0e6b2ab1a970a32ecf46d6c83971e173f481ecf7e87184260a9 The package @athena-ui-components/axios was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2683 Malicious code in @athena-ui-components/axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec575fc86c9df0e6b2ab1a970a32ecf46d6c83971e173f481ecf7e87184260a9 The package @athena-ui-components/axios was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in @athena-ui-components/dashboard-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dde903dbeed027bf706e148f4e85f93dd117d93441dddea76703a801a81a5b2d The package @athena-ui-components/dashboard-widget was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in @athena-ui-components/deeplink (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f74fbec503fca2e61a016a70e66269c234d5329e19a1072a7f777c59fc4d466c The package @athena-ui-components/deeplink was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2682 Malicious code in @athena-ui-components/deeplink (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f74fbec503fca2e61a016a70e66269c234d5329e19a1072a7f777c59fc4d466c The package @athena-ui-components/deeplink was found to contain malicious code. Source: ossf-package-analysis...

VulnCheck KEV: CVE-2025-55184

A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafe...

Pega Platform security vulnerabilities

Pega Platform is an enterprise management platform developed by Pega, Inc. Versions of Pega Platform from 8.1.0 to 25.1.1 have security vulnerabilities, which stem from storage cross-site scripting in the user interface components...

Out-of-bounds Write

Overview Magick.NET-Q8-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Out-of-bounds Write

Overview Magick.NET-Q8-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

GHSA-PMPG-6PWW-FG6Q ImageMagick has out-of-bounds access in ConnectedComponentsImage() via CLI-controlled connected-components:* artifacts

When the connected-components: define specifies an invalid index and out of bound operation will result in an access violation...

Out-of-bounds Write

Overview Magick.NET-Q16-HDRI-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Out-of-bounds Write

Overview Magick.NET-Q16-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...