MAL-2025-190840 Malicious code in esbuild-plugin-eta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eee6c2c46a6a594f389aa85580f033eb39c879f80478d3cca6d746bd8f8afe21 The package esbuild-plugin-eta was found to contain malicious code. Source: ghsa-malware...

Malware in esbuild-plugin-httpfile

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in esbuild-plugin-httpfile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efc9c8640b4324e3d5e06e51fa01e3029117ab9121c0baa55b1f81b1b73019a8 The package esbuild-plugin-httpfile was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-198739

Malicious code in esbuild-plugin-httpfile npm...

EUVD-2025-5060

Malicious code in bioql PyPI...

MAL-2025-19818 Malicious code in esbuild-linux-arm32 (npm)

The package esbuild-linux-arm32 was found to contain malicious code...

Malicious code in esbuild-linux-arm32 (npm)

The package esbuild-linux-arm32 was found to contain malicious code...

openSUSE 15 Security Update : chromium (openSUSE-SU-2025:0145-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025:0145-1 advisory. - Chromium 136.0.7103.48 stable release 2025-04-29 boo1242153 CVE-2025-4096: Heap buffer overflow in HTML. Reported by Anonymous on 2025-04-11...

OPENSUSE-SU-2025:0145-1 Security update for chromium

This update for chromium fixes the following issues: - Chromium 136.0.7103.48 stable release 2025-04-29 boo1242153 CVE-2025-4096: Heap buffer overflow in HTML. Reported by Anonymous on 2025-04-11 CVE-2025-4050: Out of bounds memory access in DevTools. Reported by Anonymous on 2025-04-09...

@aligent/cdk-esbuild (>=2.0.0, <=2.1.0), @aligent/cdk-graphql-mesh-server (>=0.1.5, <=2.17.0) +425 more potentially affected by unknown CVE via aws-cdk-lib (>=2.0.0-alpha.4, <=2.188.0)

aws-cdk-lib NPM version =2.0.0-alpha.4, =2.0.0, =0.1.5, =2.3.7, =2.0.1, =2.0.0, =2.0.0-beta, =0.0.3, =5.0.0-ampgenconfig.0, =2.7.0-a-cdkv2-graphql-15.0, =5.0.0-beta.0, =4.1.10-alpha.74, =3.0.0-ampgenconfig.0, =3.0.0-ampgenconfig.0, =3.1.28 and more Source cves: unknown CVE Source advisory:...

GHSA-32CH-6X54-Q4H9 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, wazero, kube-rbac-proxy, q, kwok, go-licenses, kubernetes-event-exporter, esbuild, secrets-store-csi-driver-provider-aws, trillian, nri-kafka, paranoia, vt-cli, cfssl, shfmt, chartmuseum, docker-credential-ecr-login, nerdctl, kube-state-metrics,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: pulumi-language-java, wazero, kube-rbac-proxy, q, kwok, go-licenses, kubernetes-event-exporter, esbuild, secrets-store-csi-driver-provider-aws, trillian, nri-kafka, paranoia, vt-cli, cfssl, shfmt, chartmuseum, docker-credential-ecr-login, nerdctl, kube-state-metrics,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, wazero, kube-rbac-proxy, q, kwok, go-licenses, kubernetes-event-exporter, esbuild, secrets-store-csi-driver-provider-aws, trillian, nri-kafka, paranoia, vt-cli, cfssl, shfmt, chartmuseum, docker-credential-ecr-login, nerdctl, kube-state-metrics,...

128981semzub (1.0.1), 1food-menu (>=0.0.1, <=0.3.8) +25435 more potentially affected by unknown CVE via esbuild (>=0.0.0, <=0.24.2)

esbuild NPM version =0.0.0, =0.0.1, =0.0.1, =1.0.0, =1.0.1, =0.1.0, =0.0.1, =0.0.4, =0.0.1, =1.0.0, =1.1.0 - 7qb-cli 2.0.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-67MH-4WV8-2F99...

esbuild enables any website to send any requests to the development server and read the response

Summary esbuild allows any websites to send any request to the development server and read the response due to default CORS settings. Details esbuild sets Access-Control-Allow-Origin: header to all requests, including the SSE connection, which allows any websites to send any request to the...

128981semzub (1.0.1), 1food-menu (>=0.0.1, <=0.3.8) +25435 more potentially affected by unknown CVE via esbuild (>=0.0.0, <=0.24.2)

esbuild NPM version =0.0.0, =0.0.1, =0.0.1, =1.0.0, =1.0.1, =0.1.0, =0.0.1, =0.0.4, =0.0.1, =1.0.0, =1.1.0 - 7qb-cli 2.0.0 and more Source cves: unknown CVE Source advisory: GHSA-67MH-4WV8-2F99...

PT-2025-6214 · Esbuild · Esbuild

Name of the Vulnerable Software and Affected Versions: esbuild affected versions not specified Description: The issue allows any website to send requests to the development server and read the response due to default CORS settings. This is because esbuild sets the Access-Control-Allow-Origin:...

MAL-2024-9597 Malicious code in esbuild-plugin-global-externals (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in esbuild-plugin-global-externals (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: pulumi-language-java, wazero, kube-rbac-proxy, q, kwok, go-licenses, kubernetes-event-exporter, esbuild, secrets-store-csi-driver-provider-aws, trillian, nri-kafka, paranoia, vt-cli, cfssl, shfmt, chartmuseum, docker-credential-ecr-login, nerdctl, kube-state-metrics,...