CVE-2026-93675: Expected Behavior Violation

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion...

Malicious code in css-jptvix-polyfill (npm)

Source: amazon-inspector cea61788c370593a2720461d06b74942933d38d30b449851a05541b5b7f189aa The package ships thunderboltRegistry.js, a Proxy-based shim that exports names mimicking internal Wix thunderbolt modules thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry,...

MAL-2026-17639 Malicious code in lore-cs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84e496d81c3e514ec784db2d5996a9015fa9f01f50cb75a99011eb348b2aa07 lore-cs 1.0.0 executes an outbound HTTP POST both from setup.py at install time and from lorecs/init.py at import time to the hardcoded bare-IP...

Malicious code in lore-cs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84e496d81c3e514ec784db2d5996a9015fa9f01f50cb75a99011eb348b2aa07 lore-cs 1.0.0 executes an outbound HTTP POST both from setup.py at install time and from lorecs/init.py at import time to the hardcoded bare-IP...

ai.pipestream.module:module-opensearch-sink (>=0.1.2, <=0.1.4), ai.pipestream.module:module-testing-sidecar (0.0.1) +3617 more potentially affected by CVE-2026-106453 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.11.1)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =0.1.2, =0.0.22, =0.1.18, =0.1.7, =0.7.24, =0.7.24, =0.7.24, =0.1.29, =0.7.22, =0.7.12, =0.7.41 - ai.pipestream:repository-service 0.0.1 and more Source cves: CVE-2026-106453 Source advisory: MEND:CVE-2026-106453...

MAL-2026-17638 Malicious code in css-jptvix-polyfill (npm)

[email protected] was published to npm on 2026-10-06 07:29 UTC by user naorya and was unpublished by npm on 2026-10-06 15:04 UTC after a malware report. It is described as a CSS polyfill but contains no polyfill: index.js is an empty module, registry-manifest.min.json maps Wix-internal...

ai.pipestream.module:module-opensearch-sink (>=0.1.2, <=0.1.4), ai.pipestream.module:module-testing-sidecar (0.0.1) +3689 more potentially affected by CVE-2026-106451 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.11.3)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =0.1.2, =0.0.22, =0.1.18, =0.1.7, =0.7.24, =0.7.24, =0.7.24, =0.1.29, =0.7.22, =0.7.12, =0.7.41 - ai.pipestream:repository-service 0.0.1 and more Source cves: CVE-2026-106451 Source advisory: MEND:CVE-2026-106451...

io.camunda:camunda-zeebe (>=8.9.0-alpha5-rc1, <=8.9.0-alpha5), io.camunda:tasklist-webapp (>=8.9.0-alpha5-rc1, <=8.9.0-alpha5) +16 more potentially affected by CVE-2026-103008 via org.elasticsearch:elasticsearch-geo (>=8.12.0, <=8.19.22)

org.elasticsearch:elasticsearch-geo MAVEN version =8.12.0, =8.9.0-alpha5-rc1, =8.9.0-alpha5-rc1, =main-272, =main-272, =main-272, =0.87.0, =7.25.0, =8.12.0.0, =8.12.0.0, =8.12.0.0, =8.12.0.0, =8.12.0, =8.12.0, =8.12.0, =2.1, =3.0.0 and more Source cves: CVE-2026-103008 Source advisory:...

io.camunda:camunda-zeebe (>=8.9.0-alpha5-rc1, <=8.9.0-alpha5), io.camunda:tasklist-webapp (>=8.9.0-alpha5-rc1, <=8.9.0-alpha5) +15 more potentially affected by CVE-2026-103008 via org.elasticsearch:elasticsearch (>=8.12.0, <=8.19.22)

org.elasticsearch:elasticsearch MAVEN version =8.12.0, =8.9.0-alpha5-rc1, =8.9.0-alpha5-rc1, =main-272, =main-272, =main-272, =0.87.0, =7.25.0, =8.12.0.0, =8.12.0.0, =8.12.0.0, =8.12.0.0, =8.12.0, =8.12.0, =2.1, =3.0.0 - org.opennms.elasticsearch:elasticsearch-drift-plugin-8.18.2 2.0.7 and more...

ai.hyacinth.framework:core-service-bus-support (>=0.5.0, <=0.5.24), ai.platon.pulsar:browser4-agent-tools (>=4.13.5, <=4.14.0-rc.2) +3400 more potentially affected by CVE-2026-106121 via com.rabbitmq:amqp-client (>=5.0.0, <=5.36.0)

com.rabbitmq:amqp-client MAVEN version =5.0.0, =0.5.0, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2 - ai.platon.pulsar:browser4-seo 4.14.0-rc.2 and more Source cves: CVE-2026-106121 Source advisory:...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +80 more potentially affected by CVE-2026-105868 via payload (>=0.8.2, <=3.89.0)

payload NPM version =0.8.2, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.1, =1.0.1-beta.0, =1.0.1, =0.14.0, =1.0.0, =1.0.0, =0.1.0, =1.0.0, =1.1.29 and more Source cves: CVE-2026-105868 Source advisory: MEND:CVE-2026-105868...

@01.software/cli (>=0.1.1, <=0.2.0), @01.software/sdk (>=0.0.1-251008.90016, <=0.3.0) +31 more potentially affected by CVE-2026-105854 via payload (>=3.0.1, <=3.89.0)

payload NPM version =3.0.1, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.25, =1.0.1-beta.0, =0.14.0, =1.0.0, =0.1.0, =3.1.0-types, =1.0.0, =3.64.0, =3.89.0 and more Source cves: CVE-2026-105854 Source advisory: OSV:GHSA-2G7P-5934-Q4W7...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +5688 more potentially affected by CVE-2026-104850 via @modelcontextprotocol/sdk (>=1.12.0, <=1.30.1)

@modelcontextprotocol/sdk NPM version =1.12.0, =0.3.3, =1.0.0, =0.2.0, =1.14.1, =1.0.0, =0.1.3, =0.1.8, =0.1.0, =0.2.0, =0.38.0, =1.0.0, =0.2.0, =8.0.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-104850 Source advisory: OSV:GHSA-6QXP-VCCF-F47H...

@ache-lol/cli (>=0.1.97, <=0.1.99), @ada-mcp/mcp-server (>=0.1.0, <=0.1.1) +189 more potentially affected by CVE-2026-102422 via shell-quote (>=1.8.4, <=1.10.0)

shell-quote NPM version =1.8.4, =0.1.97, =0.1.0, =0.1.0, =0.0.13, =14.0.13, =10.0.0-rc.2, =3.0.0-beta.0, =1.0.0, =2.0.0-rc.1, =6.0.4, =4.0.0-rc.1, =1.0.0-beta.0, =4.0.0-rc.1, =1.0.0, =1.0.15 and more Source cves: CVE-2026-102422 Source advisory: OSV:GHSA-PQG4-J6R4-53MV...

django-heralder (0.5.0), django-query-guard (0.2.1) +18 more potentially affected by CVE-2026-87890 via django (>=6.1.0, <=6.1.1)

django PYPI version =6.1.0, =0.1.17, =0.1.3, =0.2.1, =1.0.0, =0.0.9, =0.0.0, =4.7.0b1, =1.0.0, =1.0.1 and more Source cves: CVE-2026-87890 Source advisory: MEND:CVE-2026-87890...

ROOT-APP-NPM-CVE-2026-13697 CVE-2026-13697 in undici - Patched by Root

Root has patched CVE-2026-13697 in the undici package for Root:npm. Multiple fixed versions available...

Malicious code in @pinecone-experience/messages (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 078ce187b38122a7eff5def33454871232cdd38bde7d35e7ee1968d0e98cd45c package.json declares its sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.3.tgz...

MAL-2026-17631 Malicious code in @pinecone-experience/messages (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 078ce187b38122a7eff5def33454871232cdd38bde7d35e7ee1968d0e98cd45c package.json declares its sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.3.tgz...

@adamwdennis/nestjs-typeorm-cursor-pagination (1.0.0), @ambak/nest-logger (>=1.0.11, <=1.1.0) +195 more potentially affected by CVE-2026-104852 via @graphql-tools/utils (>=12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, <=12.0.1-rc-20260907155438-70f93ec122ac510059d67d2c95fa983767d228e4)

@graphql-tools/utils NPM version =12.0.0-alpha-20260805121238-f73ffd0c8126377e841d94b8bb2db97f34af4c41, =1.0.11, =0.0.1, =1.0.0, =0.0.6, =1.2.5, =2.0.0, =1.0.8, =1.0.0, =1.0.7, =0.0.1, =1.0.0, =0.0.73, =0.0.3, =0.0.44 and more Source cves: CVE-2026-104852 Source advisory:...

aiida-core (>=2.1.0, <=2.2.2), sepal-ui (>=2.10.3, <=2.13.0) potentially affected by CVE-2026-102598 via werkzeug (2.2.0a1)

werkzeug PYPI version 2.2.0a1 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - aiida-core =2.1.0, =2.10.3, =2.13.0 Source cves: CVE-2026-102598 Source advisory: OSV:GHSA-G6X2-HCCM-HH4M...