424 matches found
PT-2026-22104
Name of the Vulnerable Software and Affected Versions Koa versions prior to 3.1.2 Koa versions prior to 2.16.4 Description Koa middleware for Node.js, using ES2017 async functions, has an issue where the ctx.hostname API improperly parses the HTTP Host header. The parsing does not validate input...
Regular Expression Denial of Service (ReDoS)
Overview @apollo/server is a spec-compliant GraphQL server that's compatible with any GraphQL client, including Apollo Client. Successor to apollo-server-core, et al. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the startStandaloneServer...
Regular Expression Denial of Service (ReDoS)
Overview apollo-server is a Production ready GraphQL Server Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the startStandaloneServer function. An attacker can cause the server to become unresponsive by sending specially crafted request bodies wi...
CVE-2026-1124 Yonyou KSOA HTTP GET Parameter work_report.jsp sql injection
A security flaw has been discovered in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /worksheet/workreport.jsp of the component HTTP GET Parameter Handler. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the...
Open Redirect
Koa is vulnerable to Open Redirect. The vulnerability is due to improper validation of the Referer header in the back redirect functionality, which allows an attacker to craft specially formed URLs treated as safe relative paths and force a user’s browser to redirect to an external, potentially...
EUVD-2025-179365
Malicious code in deimos-koa-build-figures npm...
EUVD-2025-176760
Malicious code in redshift-run-script-chai-koa npm...
EUVD-2025-178182
Malicious code in koa-higgs-jasmine-wezen npm...
EUVD-2025-178185
Malicious code in koa-betelgeuse-luna-cassini npm...
Malicious code in koa-higgs-jasmine-wezen (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a94744e4363382314160fd2c7e5b498755be2a10ae9e8fa7b684813a28d90a46 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-178179
Malicious code in koa-version-scorpius-ceres npm...
Malicious code in miranda-koa-fetch-duplex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0542faa9fd01fa72c958cf46a1d5a08f0ba4db727709a088052187230321c063 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-177902
Malicious code in mensa-koa-castor-typeorm npm...
EUVD-2025-179410
Malicious code in dagda-ophiuchus-koa-solarnebula npm...
EUVD-2025-178411
Malicious code in ini-koa-adonis-astrometry npm...
MAL-2025-187471 Malicious code in ini-koa-adonis-astrometry (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 814dda9fc098a95449685bf70ed597eaf7718a69688a6739317f7af0058ac94c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-187980 Malicious code in mensa-koa-castor-typeorm (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75c11e9097d5c00ae335a975d0bd038394411ebb396691bf1af493adad32a9d1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in xerxes-koa-promise-meteor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f7f2f61998e11d01a86b314c656f657f5b480c9796ae6910da2c471584dfafc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...