CVE-2021-43616

Repo demonstrating CVE-2021-43616 / https://github.com/npm/cli/issues/2701 Remove the nodemodules folder and run npx npm@8 ci, you can see how npm will install version 2.2.x 2.2.16 at the time of this commit even though package-lock.json requires 2.0.0 root@kitploit: cat...

Fedora 44 : apache-ivy (2026-c02768c662)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c02768c662 advisory. IMPROVEMENT: ivy:retrieve and the 'post resolve tasks' now support the override child element. IVY-1664 IMPROVEMENT: ivy:makepom will now add override elemen...

CVE-2026-82327

A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that...

Unsafe Dependency Resolution

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the GraphiQL. An attacker can execute arbitrary JavaScript code in the context of users' browsers by compromising t...

PT-2026-78408

Name of the Vulnerable Software and Affected Versions Renovate versions 43.65.0 through 43.102.10 Description A remote code execution issue exists in the bazel-module and bazelisk managers when the lockFileMaintenance feature is enabled. An attacker can execute arbitrary code by supplying malicio...

Unsafe Dependency Resolution

Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution in the COPY FROM STDIN process. An attacker can execute arbitrary commands by injecting specially crafted data lines when an early failure occurs before the server signals readiness for input rows. This is...

Security update for gleam (moderate)

openSUSE security update: security update for gleam ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21557-1 Rating: moderate References: bsc1272992 Cross-References: CVE-2026-59247 Affected Products: openSUSE Leap 16.0...

OPENSUSE-SU-2026:21557-1 Security update for gleam

This update for gleam fixes the following issues: Changes in gleam: - Update to 1.18.1: CVE-2026-59247: insufficient verification of data authenticity allows a MITM adversary to substitute forged Hex package contents during dependency resolution bsc1272992 Set minimum required Erlang version to 2...

SUSE CVE-2026-59247

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

CVE-2026-59247 Insufficient verification of Hex package metadata in Gleam

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

EUVD-2026-50362

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

CVE-2026-59247 Insufficient verification of Hex package metadata in Gleam

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

EEF-CVE-2026-59247 Insufficient verification of Hex package metadata in Gleam

Summary Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which...

CVE-2026-59247

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

CVE-2026-59247 Insufficient verification of Hex package metadata in Gleam

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

CVE-2026-59247

CVE-2026-59247 describes an integrity issue in Gleam where dependency resolution can be hijacked by a network attacker. During resolution, Gleam fetches signed repository metadata but then queries an unsigned API for release data and writes the outer_checksum and dependency names into manifest.to...

PT-2026-65798

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

Unsafe Dependency Resolution

Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the IsSafeFileReference function. An attacker can access or disclose files outside the intended package boundary by supplying a crafted percent-encoded or multi-encoded file reference in the OpenAPI...

Unsafe Dependency Resolution

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the setup-mode. An attacker can execute unauthorized code or persist actions beyond their intended authorization level by supplying or controlling untrust...

Unsafe Dependency Resolution

Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution when the gh codespace jupyter process opens a JupyterLab URL supplied by a process inside a Codespace without validating that it is a loopback HTTP or HTTPS address. An attacker can execute arbitrary command...