GHSA-GV7W-RQVM-QJHR Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY

Withdrawn Advisory This advisory has been withdrawn because the affected package was incorrectly identified and the actual affected package is not in a supported ecosystem. This link is maintained to preserve external references. Original Description Summary The esbuild Deno module lib/deno/mod.t...

openSUSE 16 Security Update : syft (openSUSE-SU-2026:20928-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20928-1 advisory. Changes in syft: - Update to version 1.45.0: Added Features - Add support for ZapAddOns as jar files 4654 4932 @douglasclarke - MySQL binary classifier...

PT-2026-48379

Name of the Vulnerable Software and Affected Versions yt-dlp versions prior to 2026.06.09 Description A flaw allows a remote attacker to write arbitrary OS-shortcut files, such as .desktop, .url, and .webloc, to the user's filesystem. This occurs because the file extension allowlist used to preve...

PT-2026-48380

Name of the Vulnerable Software and Affected Versions yt-dlp versions prior to 2026.06.09 Description When using aria2c as an external downloader for fragmented manifest formats like HLS or DASH streams, insufficiently sanitized input allows an attacker to perform arbitrary file writes. This occu...

PT-2026-48378

Name of the Vulnerable Software and Affected Versions yt-dlp versions 2023.09.24 through 2026.06.08 Description When curl is used as an external downloader, cookies may be leaked to an unintended host during an HTTP redirect or when the host for download fragments differs from the parent manifest...

Deno's TLS retry copies stale upgrade hook, risking plaintext traffic

Summary A flaw in Deno's Node.js tls compatibility layer could cause a TLS client to transmit application data in plaintext after a connection retry. When autoSelectFamily was enabled and the first address-family attempt failed, the socket reinitialization path reused a stale TLS upgrade hook tha...

GHSA-CHQV-56WV-7564 Deno's TLS retry copies stale upgrade hook, risking plaintext traffic

Summary A flaw in Deno's Node.js tls compatibility layer could cause a TLS client to transmit application data in plaintext after a connection retry. When autoSelectFamily was enabled and the first address-family attempt failed, the socket reinitialization path reused a stale TLS upgrade hook tha...

CVE-2026-49406

creationtimestamp| type| source ---|---|--- 2026-05-27 13:09:16+00:00| published-proof-of-concept| https://github.com/denoland/deno/security/advisories/GHSA-968w-xfqw-vp9q...

CVE-2026-49402

creationtimestamp| type| source ---|---|--- 2026-05-27 13:08:13+00:00| published-proof-of-concept| https://github.com/denoland/deno/security/advisories/GHSA-7xh3-mhg9-jcw8 2026-06-17 10:36:55+00:00| seen| https://bsky.app/profile/azu.bsky.social/post/3moi4lqjxxk2f 2026-07-23 00:07:07+00:00| seen|...

CVE-2026-44726

creationtimestamp| type| source ---|---|--- 2026-05-27 13:04:30+00:00| published-proof-of-concept| https://github.com/denoland/deno/security/advisories/GHSA-chqv-56wv-7564...

PT-2026-44129

Name of the Vulnerable Software and Affected Versions Deno versions 2.0.0 through 2.7.7 Description A flaw in the Node.js tls compatibility layer can cause a TLS client to transmit application data in plaintext after a connection retry. This occurs when the autoSelectFamily variable is enabled an...

Fake software on GitHub and SourceForge distribute Deno RAT

During our threat hunting activities, we found fake installers and plugins impersonating popular software including ChatGPT, Claude, AutoTune, and Kontakt on GitHub and SourceForge distributing a Deno backdoor known as DinDoor. Attackers are using compromised YouTube channels to distribute links ...

CVE-2026-41690

18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting the middleware, via two unvalidated entry points that...

GHSA-Q2QQ-HMJ6-3WPP vulnerabilities

Vulnerabilities for packages: shadowsocks-rust, linkerd2-proxy, vector, deno, ztunnel...

GHSA-3V94-MW7P-V465 vulnerabilities

Vulnerabilities for packages: shadowsocks-rust, linkerd2-proxy, vector, deno, ztunnel...

GHSA-3V94-MW7P-V465 vulnerabilities

Vulnerabilities for packages: ztunnel, ztunnel-fips, shadowsocks-rust, linkerd2-proxy, komodo, vector, deno...

GHSA-Q2QQ-HMJ6-3WPP vulnerabilities

Vulnerabilities for packages: ztunnel, ztunnel-fips, shadowsocks-rust, linkerd2-proxy, komodo, vector, deno...

CVE-2026-42327 vulnerabilities

Vulnerabilities for packages: rustup, sqlx, deno, vector, rpm-sequoia, sccache, sdp-k8s-injector...

GHSA-XP3W-R5P5-63RR vulnerabilities

Vulnerabilities for packages: rustup, sqlx, deno, vector, rpm-sequoia, sccache, sdp-k8s-injector...

GHSA-XP3W-R5P5-63RR vulnerabilities

Vulnerabilities for packages: sentry-cli, sqlx, sdp-k8s-injector, ztunnel-fips, valkey-ldap, komodo, rustls-openssl-client, bootc, rpm-sequoia, rustup, sccache, vector, typst, guestproxyagent, deno...