PT-2026-104588

Name of the Vulnerable Software and Affected Versions act runner affected versions not specified Description The act runner appends workflow-controlled jobs..container.options directly to the Docker HostConfig for the job container. When privileged mode is disabled, the system only forces the...

Command Path Injection

This plugin identifies PATH environment variables either at the system or user level that could be leveraged by a local attacker for path based command injection. Path command injection happens when a PATH places user controlled directories, relative paths or world writable directories ahead of...

Malicious code in @vallensofficial/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02adc12975b9798883d78640d5cab1a73420818d23fbd192ebb76a384f056d54 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-84292

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host t...

CVE-2026-84292

fast-uri , a URI library in the Fastify ecosystem, fails to validate the port component when serializing an authority. The recomposeAuthority function concatenates the port verbatim without escaping, so a crafted non-digit value (e.g., containing @) can inject authority delimiters, demoting the i...

CVE-2026-84292 fast-uri vulnerable to authority injection via an unvalidated port in serialize

fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host t...

MAL-2026-15662 Malicious code in @yane88/term-reqable-01 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8dd1d25c85b0febc391c9ca33af1d4bbbec959413342470f159562f40ed9bd07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14774 Malicious code in 3layerdipstackhr3ocw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f7f5462a6cad4608977cbf01ae1fab24a1257afe36d254ce404ca49b5aab99c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackcfu35 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 044b8051a8aca89d5eed9f4eb9202524d9c5555e6b4c9dca0fdb8061d5449839 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14670 Malicious code in 3layerdipstack97rmzr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13188e2cc25d797008ddcbc32e1f27d89e1c3de6f64ff67b9c5e021f2ac1e7c3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackuu02ly (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be0ad67d22040139dc128f8a320d0b95d67571f954898946065369d705b89550 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14729 Malicious code in 3layerdipstackds3oln (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a1497135f91ba31b1cc557c7a3b42aa6fdb7baf359f42a12d64ba790205f024 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14830 Malicious code in 3layerdipstackmiputn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f56e30fdaec0a29e17b8585f734b0f1bce4c113fee11313a7b2ae9f775053cda The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackyqrxdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d4a1b449e872d6368112e9ea9d653e7919c643eac89dfeb4a86f58468134df8 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14810 Malicious code in 3layerdipstackl21ibf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdc6ccc6467814c4ddf095d64904d3b0d2f475dbcd599ddcf02f43329cbdbf49 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstack1a4xg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5757d0297f898182175bc3d1a4ce7dc9d0161b4e24031c3442f25e565b6dfebb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in 3layerdipstack75faj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58898f40d447ea5883af6e80e7c00dcded6b56892b5b4bf8fa56ed883da39baa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15483 Malicious code in waxed-slightly-weathered-cut-copper-stairs-q0j9jdqv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 740de09d6a18503f871d0adb6336d86c38f9de167de92f8bdda0db732ed44ecb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in waxed-slightly-weathered-cut-copper-stairs-vxn9jfje (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b901e5687dde75fd156258a6b8dc56f765d25073142e8981e739c65ada4348c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in desmos-graphing-24xpfja3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49f91b5cfbfe62ede35ea0b0d55345c605b8bd0ddc150ef229bc9410a71b7c1d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...