MAL-2026-6992 Malicious code in babel-eslint-parser-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85a6f04cbf0697b6ae409fb9e5ad0e25812dac6a2f43bd95722f1903ee2f71f7 Package name babel-eslint-parser-legacy is a one-suffix confusion against the legitimate babel-eslint-parser. The package's own main is an empty stub...

Improper Neutralization of Data within XPath Expressions ('XPath Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Data within XPath Expressions 'XPath Injection' through the XPath Transform process. An attacker can cause the application to become unresponsive or crash by sending specially crafted messages that exploit thi...

GHSA-3M3Q-X3GJ-F79X OpenClaw optional voice-call plugin: webhook verification may be bypassed behind certain proxy configurations

Affected Packages / Versions This issue affects the optional voice-call plugin only. It is not enabled by default; it only applies to installations where the plugin is installed and enabled. - Package: @openclaw/voice-call - Vulnerable versions: = 2026.2.3 Legacy package name if you are still usi...

Malicious code in react-transition-group-legacy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 766e17e75d1b6492251c7c647d0783879b9fb18f0793046fc985e40a46295d63 The package react-transition-group-legacy was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-9149 Malicious code in @oss-ui/capsig-legacy (npm)

The package @oss-ui/capsig-legacy was found to contain malicious code...

Malicious code in @create-project-container/legacy (npm)

The package @create-project-container/legacy was found to contain malicious code...

MAL-2025-7733 Malicious code in @create-project-container/legacy (npm)

The package @create-project-container/legacy was found to contain malicious code...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature through the HTTPRedirect binding process. An attacker can manipulate the message processing by appending a malicious SAMLRequest in front of a valid SAMLResponse, leading to the applicati...

Malicious code in Be.Vlaanderen.Basisregistеrs.PаrсеlRegistry.Api.Legacy (NuGet)

--- -= Per source details. Do not edit below this line.=-...

Malicious Package

Overview @fabric-design/components-legacy is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable ...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality of protected information

The Linux-headers-2.6.18-4-alpha-legacy package of the Debian GNU/Linux operating system has multiple vulnerabilities. Exploitation of these vulnerabilities may lead to a violation of the confidentiality of protected information. These vulnerabilities can be exploited remotely...

FreePBX (All Versions) RCE

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We would like to announce that a significant security vulnerability has been discovered in all current versions of FreePBX. A CVE has been requested from Mitre, but has yet to be provided. Further details as they come to hand will be available from...