MAL-2026-16272 Malicious code in kartykgithub-multiversion-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf524b1c8a586bcece6d65140e168a40adec8699c1cc7af61263bfd2a6b84543 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16266 Malicious code in @kartyk-github-org/takedown-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f59dc68aae74875f986021660cb054d4055e7f7113e31234e8a9589c44edfb6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @kartyk-github-org/takedown-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf2fb1adf14524d97cbb2a621413f9d25b8ac020fc927b92fa8f9aff52edef70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @kartyk-github-org/takedown-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f59dc68aae74875f986021660cb054d4055e7f7113e31234e8a9589c44edfb6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16265 Malicious code in @kartyk-github-org/takedown-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf2fb1adf14524d97cbb2a621413f9d25b8ac020fc927b92fa8f9aff52edef70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

vim: Vim: Arbitrary code execution via Python omni-completion

A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a...

CVE-2026-77404

A flaw was found in RabbitMQ amqp091-go. The URI.String function in uri.go concatenates TLS asset path values directly into an AMQPS query string without proper encoding. If an application processes a TLS asset path containing special characters like ampersand or equals delimiters, these can be...

CVE-2026-63459

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...

Malicious code in randompkga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4e7dfd8fb150e4c7f087a17c2ed162a8e48fe7e4e253a68df901f0e775fd68c package.json declares a postinstall lifecycle script cd "$INITCWD" && npm i randompkgb that, on npm install, installs the additional npm package...

Malicious code in randompkgb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80714d50d1dce2dbe400bba24113e27d669cc28dfc0d2b9194214a6322d3dc45 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16259 Malicious code in randompkge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95eb389e78a05b76dfefafd460f3280f3fabf8fcd1dfc55946b04bef84b26116 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16257 Malicious code in randompkgc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ce22b64e51787a332ae7c65afc8789c0fb3f806199aa79d72af9ff02eb867d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16258 Malicious code in randompkgd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0ebd1d508d7c8ae4aa2a0693b9d07720a837307b1a5c343c931c6e7d72d6390 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in randompkge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95eb389e78a05b76dfefafd460f3280f3fabf8fcd1dfc55946b04bef84b26116 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in randompkgd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0ebd1d508d7c8ae4aa2a0693b9d07720a837307b1a5c343c931c6e7d72d6390 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in randompkgc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ce22b64e51787a332ae7c65afc8789c0fb3f806199aa79d72af9ff02eb867d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16256 Malicious code in randompkgb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80714d50d1dce2dbe400bba24113e27d669cc28dfc0d2b9194214a6322d3dc45 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16255 Malicious code in randompkga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4e7dfd8fb150e4c7f087a17c2ed162a8e48fe7e4e253a68df901f0e775fd68c package.json declares a postinstall lifecycle script cd "$INITCWD" && npm i randompkgb that, on npm install, installs the additional npm package...

Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Stored XSS in the Admin Dashboard via unsafe HTML-stripping innerHTML of entity descriptions Package: @vendure/dashboard vendure-ecommerce/vendure, latest master · Summary The dashboard's RichTextDescriptionCell "strips HTML" from an entity's description by assigning it to a live element's...