35876 matches found
Malicious Package
Overview @immobiliarelabs/backstage-plugin-ldap-auth-backend is a malicious package. linked to a variant of the "Miasma" supply chain attack targeting the LeoPlatform npm ecosystem. A malicious actor compromised a legitimate maintainer account and used it to publish infected versions of this...
GHSA-4MR2-FG2P-W63C vulnerabilities
Vulnerabilities for packages: traefik, traefik-fips...
CVE-2026-47067
creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:54+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-9653-rcfr-5c62...
CVE-2026-49342
creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:42+00:00| published-proof-of-concept| https://github.com/lsegal/yard/security/advisories/GHSA-pxcc-8665-phx8...
CVE-2026-53522
creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:22+00:00| published-proof-of-concept| https://github.com/nezhahq/nezha/security/advisories/GHSA-jg62-j5h6-8mpq...
CVE-2026-49338
creationtimestamp| type| source ---|---|--- 2026-06-27 00:35:07+00:00| published-proof-of-concept| https://github.com/sentriz/gonic/security/advisories/GHSA-hmgp-w9jm-vp95...
CVE-2026-49340
creationtimestamp| type| source ---|---|--- 2026-06-26 23:42:14+00:00| seen| https://gist.github.com/alon710/aef49efca881722a2606f374108f34f4 2026-06-27 00:00:58+00:00| seen| https://gist.github.com/alon710/aef49efca881722a2606f374108f34f4 2026-06-27 00:35:12+00:00| published-proof-of-concept|...
GHSA-HWX4-2J3J-G496 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
Summary pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause pnpm install - ignore-scripts to replace...
GHSA-M727-PCJM-J28H
creationtimestamp| type| source ---|---|--- 2026-06-26 22:45:45+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mp7zjccddf2o...
CVE-2026-48990
creationtimestamp| type| source ---|---|--- 2026-06-26 22:35:29+00:00| published-proof-of-concept| https://github.com/authlib/joserfc/security/advisories/GHSA-wphv-vfrh-23q5...
CVE-2026-47071
creationtimestamp| type| source ---|---|--- 2026-06-26 22:35:15+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-gp9c-pm5m-5cxr...
CVE-2026-47076
creationtimestamp| type| source ---|---|--- 2026-06-26 22:35:12+00:00| published-proof-of-concept| https://github.com/benoitc/hackney/security/advisories/GHSA-pj7v-xfvx-wmjq...
CVE-2026-49359
creationtimestamp| type| source ---|---|--- 2026-06-26 22:28:37+00:00| seen| https://bsky.app/profile/suriq.io/post/3mp7ykmyves2b 2026-06-27 00:35:49+00:00| published-proof-of-concept| https://github.com/pontedilana/php-weasyprint/security/advisories/GHSA-x8g9-h984-pc36...
NPM: pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile
NPM: pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile vulnerability discovered by ? in WordPress Npm pnpm versions 10.33.4...
EUVD-2026-39497
pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile...
pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile
Summary A malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. Details The lockfile does not store the hash of the dependencies from https://codeload.github.com This means that if this server was compromised or a person's...
Missing Support for Integrity Check
Overview pnpm is a Fast, disk space efficient package manager Affected versions of this package are vulnerable to Missing Support for Integrity Check involving GitHub git dependencies, because the tarball hash for packages resolved from codeload.github.com is not recorded in the lockfile. An...
GHSA-HG3W-7F8C-63HP pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile
Summary A malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. Details The lockfile does not store the hash of the dependencies from https://codeload.github.com This means that if this server was compromised or a person's...
CVE-2026-48749
creationtimestamp| type| source ---|---|--- 2026-06-26 20:35:27+00:00| published-proof-of-concept| https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv 2026-07-07 20:48:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mq3i2ziva52f 2026-08-21 16:07:30+00:00| see...