Malicious code in express-router-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49091d8e8923e3e709cebd14f01ee1617267bf3f9b6be99052603715b7cf9f70 The sole shipped file index.js is a heavily obfuscated RC4 + base64 string-array, 337-entry rotated array, control-flow flattening IIFE that executes...

MAL-2026-10053 Malicious code in chai-secure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4253b6520b80bd3c3ee724b9766c67a3a2d7abe074ee57e15d5b9b270bf74f55 chai-secure masquerades as a Chai plugin offering JWT/XSS/SQLi assertion helpers, but on every require/import of the package, index.js unconditionall...

CVE-2026-9235 DHL eCommerce (Benelux) for WooCommerce <= 2.2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shipping Label Creation and Deletion via dhlpwc_label_create and dhlpwc_label_delete AJAX Actions

The DHL eCommerce Benelux for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check and missing nonce verification on the createlabel and deletelabel functions in versions up to, and including, 2.2.3. These functions are wir...

Incorrect Authorization

Overview github.com/nats-io/nats-server/v2/server is an A simple, secure and performant communications system for digital systems, services and devices. Affected versions of this package are vulnerable to Incorrect Authorization in the MQTT retained message delivery and QoS1+ durable replay...

GHSA-9X82-RM84-C6X7 DSpace has possible Remote Code Execution (RCE) through Velocity Templates used by LDN

Overview Remote Code Execution RCE is possible via Velocity Templates used by DSpace for COAR Notify/LDN messages. This vulnerability impacts DSpace versions 8.0 = 8.3, 9.0 = 9.2. The attacker MUST already have DSpace administrator credentials in order to perform the attack. This attack is relate...

CVE-2026-58254

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.8, message trace destination checks were applied to ordinary client connections but not consistently to messages arriving through leafnode connections, allowing a leafnode...

AZL-92253 CVE-2026-58252 affecting package telegraf for versions less than 1.31.0-27

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, an authenticated user could receive messages on denied subjects when a wildcard subscription overlapped with a configured wildcard deny rule but was not a subset...

CVE-2026-58209

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these...

Malicious code in chai-presentation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d078bac337fe2c1b76c757c29d286fc750be585db65f30f5d696038c2ea0d3a On require, index.js issues an HTTPS GET to https://www.jsonkeeper.com/b/PC5CK and passes the response's cookie field to new Function'require',...,...

CVE-2026-56220

Capgo before version 12.128.2 contains an authorization bypass in the public.manifest INSERT policy that lets read-only org members insert OTA manifest rows. Attackers with read-only org access can inject malicious manifest entries with arbitrary s3_path values, which are served to devices via th...

CVE-2026-58254: Incorrect Authorization

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.8, message trace destination checks were applied to ordinary client connections but not consistently to messages arriving through leafnode connections, allowing a leafnode...

CVE-2026-56220: Incorrect Authorization

Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.manifest INSERT policy that allows read-only org members to insert OTA manifest rows. Attackers with read-only org access can inject malicious manifest entries with arbitrary s3path values that are served to device...

CVE-2026-58209: Incorrect Authorization

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.3 and 2.12.12, MQTT retained message delivery and QoS1+ durable replay could deliver messages whose original topics matched a subscriber configured subscribe deny rule because these...

Malicious code in picnic-store-delivery-miniapp (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7342 Malicious code in picnic-store-delivery-miniapp (npm)

--- -= Per source details. Do not edit below this line.=-...

nats-server: NATS Server: Information disclosure due to inconsistent MQTT topic rechecking

A flaw was found in NATS Server. This vulnerability allows for unauthorized information disclosure where MQTT messages, intended to be denied based on subscription rules, are still delivered to subscribers. This occurs because the server's delivery paths do not consistently recheck the original...

nats-server: NATS Server: Denial of Service via inconsistent message trace destination checks

A flaw was found in NATS Server. Message trace destination checks, which ensure that trace events are sent to authorized subjects, were not consistently applied to messages originating from leafnode connections. This inconsistency allows a leafnode operator to bypass these checks and send trace...

nats-server: NATS Server: Denial of Service via inconsistent message trace destination checks

A flaw was found in NATS Server. Message trace destination checks, which ensure that trace events are sent to authorized subjects, were not consistently applied to messages originating from leafnode connections. This inconsistency allows a leafnode operator to bypass these checks and send trace...

NetScaler ADC Buffer Overflow DoS

The vulnerability of the NetScaler ADC application delivery controller previously Citrix ADC and the NetScaler Gateway virtual environment access control system previously Citrix Gateway is related to operations that go beyond the buffer in memory. Exploiting this vulnerability could allow a...

NetScaler ADC File Path Access

The vulnerability of NetScaler ADC formerly Citrix ADC and NetScaler Gateway formerly Citrix Gateway access control systems is related to improper external management of file names or paths. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...