Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...

ROOT-APP-NPM-GHSA-6X33-PW7P-HMPQ GHSA-6x33-pw7p-hmpq in http-proxy - Patched by Root

Root has patched GHSA-6x33-pw7p-hmpq in the http-proxy package for Root:npm. Multiple fixed versions available...

GHSA-V3R7-H72X-CJCM vulnerabilities

Vulnerabilities for packages: kibana, pulumi, langfuse, actions-runner, langfuse-fips, prism, code-server, renovate, vitess, npm, pelias-api...

GHSA-MFX4-HV73-Q22V vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.13-sdk, dask-kubernetes, airflow-core, py3-cassandra-medusa, text-generation-inference, apache-beam-python-3.11-sdk, kserve, tritonserver-backend-vllm-cuda-13.0, puppygraph-python, airflow, apache-beam-python-3.12-sdk, kserve-models-web-app,...

GHSA-954P-556P-R752 vulnerabilities

Vulnerabilities for packages: label-studio...

GHSA-RFR2-MQ9M-X2QX vulnerabilities

Vulnerabilities for packages: label-studio...

GHSA-MQQ9-GXG5-M58G vulnerabilities

Vulnerabilities for packages: nextcloud-server...

MAL-2026-11848 Malicious code in @servicetitan/culture (npm)

npm/@servicetitan/culture is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...

Malicious code in @or-sdk/account-settings (npm)

npm/@or-sdk/account-settings is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11665 Malicious code in @or-sdk/account-settings (npm)

npm/@or-sdk/account-settings is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @onereach/step-components (npm)

npm/@onereach/step-components is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @or-sdk/views (npm)

npm/@or-sdk/views is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by th...

MAL-2026-11652 Malicious code in @onereach/step-components (npm)

npm/@onereach/step-components is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11737 Malicious code in @or-sdk/views (npm)

npm/@or-sdk/views is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by th...

Malicious code in @onereach/si-validated-timestring-input (npm)

npm/@onereach/si-validated-timestring-input is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were...

MAL-2026-11649 Malicious code in @onereach/si-validated-timestring-input (npm)

npm/@onereach/si-validated-timestring-input is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were...

MAL-2026-11929 Malicious code in @servicetitan/table (npm)

npm/@servicetitan/table is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...

Malicious code in @or-sdk/deployer (npm)

npm/@or-sdk/deployer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...

Malicious code in @servicetitan/table (npm)

npm/@servicetitan/table is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished...

MAL-2026-11687 Malicious code in @or-sdk/deployer (npm)

npm/@or-sdk/deployer is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished by...