CVE-2026-48089

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any authenticated user — including users from a different organization with no membership or role in the affected org/project — can create,...

CVE-2026-48089 DevGuard has improper authorization on public assets

DevGuard provides vulnerability management for the full software supply chain. Prior to 1.4.2, on a DevGuard API instance with one or more public assets, any authenticated user — including users from a different organization with no membership or role in the affected org/project — can create,...

@openinc/parse-server-opendash (>=4.0.0, <=4.0.29) potentially affected by CVE-2026-55778 via parse-server (>=9.6.0-alpha.37, <=9.8.0)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.0.29 Source cves: CVE-2026-55778 Source advisory: SNYK:JS-PARSESERVER-17420047...

@openinc/parse-server-opendash (>=4.0.0, <=4.0.29) potentially affected by CVE-2026-55778 via parse-server (>=9.6.0-alpha.37, <=9.8.0)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.0.29 Source cves: CVE-2026-55778 Source advisory: OSV:GHSA-V8X7-R927-CC93...

@kontaa/subgraph (>=1.0.1, <=1.2.3), @kontaa/utils (>=1.2.1, <=1.2.3) +4 more potentially affected by CVE-2026-55778 via parse-server (>=6.5.11, <=7.5.4)

parse-server NPM version =6.5.11, =1.0.1, =1.2.1, =2.4.46, =1.0.1, =1.0.0, =1.0.0, =1.0.1 Source cves: CVE-2026-55778 Source advisory: SNYK:JS-PARSESERVER-17420047...

@jupyterlab/pullrequests (>=2.0.0-alpha.0, <=3.0.2) potentially affected by CVE-2026-54527 via @jupyterlab/git (>=0.30.0, <=0.40.0)

@jupyterlab/git NPM version =0.30.0, =2.0.0-alpha.0, =3.0.2 Source cves: CVE-2026-54527 Source advisory: SNYK:JS-JUPYTERLABGIT-17391473...

@jupyterlab/pullrequests (>=2.0.0-alpha.0, <=3.0.2) potentially affected by CVE-2026-54527 via @jupyterlab/git (>=0.30.0, <=0.40.0)

@jupyterlab/git NPM version =0.30.0, =2.0.0-alpha.0, =3.0.2 Source cves: CVE-2026-54527 Source advisory: OSV:GHSA-F962-V9HR-PFG5...

@openinc/parse-server-opendash (>=4.0.0, <=4.0.29) potentially affected by CVE-2026-53726 via parse-server (>=9.6.0-alpha.37, <=9.8.0)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.0.29 Source cves: CVE-2026-53726 Source advisory: OSV:GHSA-WMWX-JR2P-4J4R...

@openinc/parse-server-opendash (>=4.0.12, <=4.0.29) potentially affected by CVE-2026-53725 via parse-server (9.8.0)

parse-server NPM version 9.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-server and may be impacted: - @openinc/parse-server-opendash =4.0.12, =4.0.29 Source cves: CVE-2026-53725 Source advisory: OSV:GHSA-75V4-M273-5J49...

@openinc/parse-server-opendash (>=4.0.0, <=4.0.29) potentially affected by CVE-2026-53724 via parse-server (>=9.6.0-alpha.37, <=9.8.0)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.0.29 Source cves: CVE-2026-53724 Source advisory: OSV:GHSA-7WQV-XJF3-X35V...

@openinc/parse-server-opendash (>=4.0.12, <=4.0.29) potentially affected by CVE-2026-50008 via parse-server (9.8.0)

parse-server NPM version 9.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-server and may be impacted: - @openinc/parse-server-opendash =4.0.12, =4.0.29 Source cves: CVE-2026-50008 Source advisory: OSV:GHSA-P84R-H6RX-F2XR...

@142vip/midway (>=0.1.6-alpha.9, <=0.1.6-alpha.12), @142vip/nest-starter (>=0.0.1-alpha.1, <=0.0.1-alpha.13) +2871 more potentially affected by unknown CVE via typeorm (>=0.1.14, <=0.3.28)

typeorm NPM version =0.1.14, =0.1.6-alpha.9, =0.0.1-alpha.1, =0.0.1-alpha.1, =1.0.1, =3.3.4, =1.0.1, =0.0.1, =0.9.3, =1.0.0, =1.1.126, =1.0.0, =1.0.0, =1.0.14 - @actonate/mirkwood 0.10.1 and more Source cves: unknown CVE Source advisory: SNYK:JS-TYPEORM-17391479...

@142vip/midway (>=0.1.6-alpha.9, <=0.1.6-alpha.12), @142vip/nest-starter (>=0.0.1-alpha.1, <=0.0.1-alpha.13) +2871 more potentially affected by unknown CVE via typeorm (>=0.1.14, <=0.3.28)

typeorm NPM version =0.1.14, =0.1.6-alpha.9, =0.0.1-alpha.1, =0.0.1-alpha.1, =1.0.1, =3.3.4, =1.0.1, =0.0.1, =0.9.3, =1.0.0, =1.1.126, =1.0.0, =1.0.0, =1.0.14 - @actonate/mirkwood 0.10.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-9GGV-8W38-R7PM...

@m3s/smart-contract (>=1.4.1, <=2.3.8), @openzeppelin/contracts-cli (0.1.0) +2 more potentially affected by unknown CVE via @openzeppelin/wizard-stellar (>=0.1.1, <=0.5.0)

@openzeppelin/wizard-stellar NPM version =0.1.1, =1.4.1, =0.0.5, =0.0.1, =0.0.4 Source cves: unknown CVE Source advisory: OSV:GHSA-9WXG-VF3R-56HC...

@m3s/smart-contract (>=1.4.1, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.4.5) +1 more potentially affected by unknown CVE via @openzeppelin/wizard-stylus (0.2.0)

@openzeppelin/wizard-stylus NPM version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @openzeppelin/wizard-stylus and may be impacted: - @m3s/smart-contract =1.4.1, =0.0.5, =0.0.1, =0.0.4 Source cves: unknown CVE Source advisory:...

@m3s/smart-contract (>=1.1.5, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.3.0) +11 more potentially affected by unknown CVE via @openzeppelin/wizard (>=0.1.1, <=0.10.8)

@openzeppelin/wizard NPM version =0.1.1, =1.1.5, =0.0.5, =0.0.1, =1.0.4, =0.0.1, =0.2.48, =0.2.63-a, =1.0.0, =0.0.1, =0.1.2 Source cves: unknown CVE Source advisory: OSV:GHSA-9WXG-VF3R-56HC...

@m3s/smart-contract (>=1.1.5, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.3.0) +11 more potentially affected by CVE-2026-57583 via @openzeppelin/wizard (>=0.1.1, <=0.10.8)

@openzeppelin/wizard NPM version =0.1.1, =1.1.5, =0.0.5, =0.0.1, =1.0.4, =0.0.1, =0.2.48, =0.2.63-a, =1.0.0, =0.0.1, =0.1.2 Source cves: CVE-2026-57583 Source advisory: SNYK:JS-OPENZEPPELINWIZARD-17817911...

@m3s/smart-contract (>=1.4.1, <=2.3.8), @openzeppelin/contracts-cli (0.1.0) +2 more potentially affected by CVE-2026-57583 via @openzeppelin/wizard-stellar (>=0.1.1, <=0.5.0)

@openzeppelin/wizard-stellar NPM version =0.1.1, =1.4.1, =0.0.5, =0.0.1, =0.0.4 Source cves: CVE-2026-57583 Source advisory: SNYK:JS-OPENZEPPELINWIZARDSTELLAR-17817909...

@m3s/smart-contract (>=1.4.1, <=2.3.8), @openzeppelin/contracts-mcp (>=0.0.5, <=0.4.5) +1 more potentially affected by CVE-2026-57583 via @openzeppelin/wizard-stylus (0.2.0)

@openzeppelin/wizard-stylus NPM version 0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on @openzeppelin/wizard-stylus and may be impacted: - @m3s/smart-contract =1.4.1, =0.0.5, =0.0.1, =0.0.4 Source cves: CVE-2026-57583 Source advisory:...

Malicious code in routecraft (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0c4f17a9e94ab9fdbab7325f597551a6c0ba5b9e210cb0b7e28d3b86b4766d0 [email protected] ships verbatim Express.js source lib/routecraft.js, lib/application.js, lib/request.js, lib/response.js, lib/utils.js, lib/view.js —...