Malicious code in @403name/fsevent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f86ca4502cc824c3684e8f1e08b088b974b4339829461b50d45e3fbc6f808eb On require, index.js runs an IIFE that gates to macOS, skips when CI or GITHUBACTIONS is set, waits 30-90 seconds, and writes a one-shot marker at...

EUVD-2026-36150

An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources...

PT-2026-48615

Name of the Vulnerable Software and Affected Versions Spring Integration versions 7.0.0 through 7.0.4 Spring Integration versions 6.5.0 through 6.5.8 Spring Integration versions 6.4.0 through 6.4.11 Spring Integration versions 6.3.0 through 6.3.14 Spring Integration versions 5.5.0 through 5.5.20...

VMware Spring Integration 路径遍历漏洞

VMware Spring Integration is an enterprise application integration framework developed by VMware, Inc. Versions 7.0.0 to 7.0.4, 6.5.0 to 6.5.8, 6.4.0 to 6.4.11, 6.3.0 to 6.3.14, and 5.5.0 to 5.5.20 of VMware Spring Integration have a path traversal vulnerability. This vulnerability arises due to...

CVE-2026-40987: Improper Limitation of a Pathname to a Restricted Directory

A malicious or compromised FTP/SFTP/SMB server can write arbitrary files anywhere on the client filesystem outside the configured local-directory with attacker-controlled content. Affected versions: Spring Integration 7.0.0 through 7.0.4; 6.5.0 through 6.5.8; 6.4.0 through 6.4.11; 6.3.0 through...

PT-2026-48644

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.0 through 18.10.7 GitLab CE/EE versions 18.11 through 18.11.4 GitLab CE/EE versions 19.0 through 19.0.1 Description An issue exists where an authenticated user can cause a denial of service on the CI/CD Catalog page...

GitLab 处理逻辑错误漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are products of the American company GitLab. GitLab Enterprise Edition is a content management system. GitLab Community Edition is a community version of GitLab. There were security vulnerabilities in versions prior to 17.0, 18.11,...

CVE-2026-0274

An improper validation of credentials vulnerability in the CommvaultSecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources...

org.jenkins-ci.main:jenkins-war (1.653), org.jenkins-ci.main:test (1.653) +9 more potentially affected by CVE-2026-53442 via org.jenkins-ci.main:jenkins-core (1.653)

org.jenkins-ci.main:jenkins-core MAVEN version 1.653 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-war 1.653 - org.jenkins-ci.main:test 1.653 -...

Access Control Bypass

Overview org.springframework.data:spring-data-rest-webmvc is a maven plugin for Spring Data REST - WebMVC. Affected versions of this package are vulnerable to Access Control Bypass in the Querydsl integration, which accepts arbitrary persistent property paths as request-parameter filter keys...

com.github.pscosta:kafka-proto-api (1.0), org.apereo.cas:cas-server-core-configuration-cloud-kafka (5.2.0-rc4) +1 more potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.2.3.release)

org.springframework.kafka:spring-kafka MAVEN version 1.2.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - com.github.pscosta:kafka-proto-api 1.0 -...

org.springframework.integration:spring-integration-kafka (2.3.1.release) potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.3.10.release)

org.springframework.kafka:spring-kafka MAVEN version 1.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.integration:spring-integration-kafka 2.3.1.release...

org.springframework.integration:spring-integration-kafka (2.1.0.release) potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.1.0.release)

org.springframework.kafka:spring-kafka MAVEN version 1.1.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.integration:spring-integration-kafka 2.1.0.release Sour...

org.springframework.integration:spring-integration-kafka (2.0.1.release) potentially affected by CVE-2026-41726 via org.springframework.kafka:spring-kafka (1.0.3.release)

org.springframework.kafka:spring-kafka MAVEN version 1.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.integration:spring-integration-kafka 2.0.1.release Sour...

GHSA-MWPV-RG79-863C Spring Data REST Querydsl Integration Exposes Persistent Property Paths, Bypassing Jackson Customizations

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

com.github.skyding228:spring-session-redis (1.0), net.mingsoft:ms-base (>=1.0.3, <=1.0.8) +14 more potentially affected by CVE-2026-41719 via org.springframework.data:spring-data-keyvalue (1.1.10.release)

org.springframework.data:spring-data-keyvalue MAVEN version 1.1.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-keyvalue and may be impacted: - com.github.skyding228:spring-session-redis 1.0 -...

EUVD-2026-35910

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

Spring Data REST Querydsl Integration Exposes Persistent Property Paths, Bypassing Jackson Customizations

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

org.springframework.data:spring-data-mongodb-cross-store (2.1.7.release), org.springframework.integration:spring-integration-mongodb (5.1.5.release) potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (2.1.7.release)

org.springframework.data:spring-data-mongodb MAVEN version 2.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.springframework.data:spring-data-mongodb-cross-store...

org.grails:grails-datastore-gorm-mongo (>=1.0.0.rc5, <=1.0.0.release), org.grails:grails-datastore-mongo (>=1.0.0.rc5, <=1.0.0.release) +2 more potentially affected by CVE-2026-41696 via org.springframework.data:spring-data-mongodb (1.0.0.release)

org.springframework.data:spring-data-mongodb MAVEN version 1.0.0.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - org.grails:grails-datastore-gorm-mongo =1.0.0.rc5, =1.0.0.rc5,...