Malicious code in @revizahoshii/hoshino-store-mongo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbbe1a1b8523eee7d05bc6e5c5dfa9e65fd25e1c42b9fed34f645048dba47b6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17828 Malicious code in @revizahoshii/hoshino-store-mongo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbbe1a1b8523eee7d05bc6e5c5dfa9e65fd25e1c42b9fed34f645048dba47b6f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @revizahoshii/hoshino-store-mongo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

CVE-2026-106437

A flaw was found in mongo-c-driver. An attacker who can influence the buffer length supplied by an embedding application can trigger an integer underflow by passing an undersized value to the Binary JSON BSON buffer-reservation function. This issue leads to out-of-bounds memory reads and writes...

CVE-2026-106431

A flaw was found in mongo-c-driver. An off-by-one error in the BSON bulk document writer allows an attacker to cause a Denial of Service DoS or memory corruption. By supplying documents of a specific cumulative size that align with a buffer boundary, an attacker can trigger a single-byte...

mongo-express 0.53.0 Remote Code Execution

mongo-express version 0.53.0 contains a remote code execution vulnerability in the checkValid endpoint's handling of the document parameter. A proof of concept and isolated vulnerable environment are included. https://packetstorm.news/download/234999...

Exploit for Code Injection in Mongo-Express_Project Mongo-Express

mongo-express Remote Code Execution CVE-2019-10758 Vulhub...

AlmaLinux 8 : ruby:2.5 (ALSA-2026:73519)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:73519 advisory. resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses CVE-2026-80212 rubygem-mongo: MongoDB Ruby Driver: Data...

gakp-pylib (>=0.2.7, <=0.9.3), khan-mongo (0.1.6) +1 more potentially affected by CVE-2026-96749 via pymongo (3.2.2)

pymongo PYPI version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - gakp-pylib =0.2.7, =1.3.0, =1.4.0 Source cves: CVE-2026-96749 Source advisory: OSV:GHSA-V4X9-3549-CRWV...

restart-mongo (>=0.1.0, <=0.1.4) potentially affected by CVE-2026-96749 via pymongo (2.7.2)

pymongo PYPI version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - restart-mongo =0.1.0, =0.1.4 Source cves: CVE-2026-96749 Source advisory: OSV:GHSA-V4X9-3549-CRWV...

appkernel (>=0.1.0, <=1.0.0), cg (>=12.1.3, <=16.3.4) +9 more potentially affected by CVE-2026-96749 via pymongo (3.6.1)

pymongo PYPI version 3.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - appkernel =0.1.0, =12.1.3, =0.0.1, =0.0.6, =1.5.0, =0.0.1, =1.0.0, =4.1.1, =0.0.29, =0.0.1, =0.0.2 Source cves: CVE-2026-96749 Source advisory:...

chatterbot (>=0.2.4, <=0.2.5), monasca-agent (1.1.20) +2 more potentially affected by CVE-2026-96749 via pymongo (3.0.3)

pymongo PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - chatterbot =0.2.4, =0.1.0, =2.2.0 - robotoff 1.0.13 Source cves: CVE-2026-96749 Source advisory: OSV:GHSA-V4X9-3549-CRWV...

restart-mongo (>=0.1.0, <=0.1.4) potentially affected by CVE-2026-88029 via pymongo (2.7.2)

pymongo PYPI version 2.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - restart-mongo =0.1.0, =0.1.4 Source cves: CVE-2026-88029 Source advisory: OSV:GHSA-8FVV-FGR5-F8CH...

chatterbot (>=0.2.4, <=0.2.5), monasca-agent (1.1.20) +2 more potentially affected by CVE-2026-88029 via pymongo (3.0.3)

pymongo PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - chatterbot =0.2.4, =0.1.0, =2.2.0 - robotoff 1.0.13 Source cves: CVE-2026-88029 Source advisory: OSV:GHSA-8FVV-FGR5-F8CH...

general-tools (>=0.1.4, <=0.2.1), happymongo-py3 (0.1.2) +3 more potentially affected by CVE-2026-88029 via pymongo (3.7.0)

pymongo PYPI version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - general-tools =0.1.4, =0.1.0, =23.0.3, =23.0.7 Source cves: CVE-2026-88029 Source advisory: OSV:GHSA-8FVV-FGR5-F8CH...

gakp-pylib (>=0.2.7, <=0.9.3), khan-mongo (0.1.6) +1 more potentially affected by CVE-2026-88029 via pymongo (3.2.2)

pymongo PYPI version 3.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - gakp-pylib =0.2.7, =1.3.0, =1.4.0 Source cves: CVE-2026-88029 Source advisory: OSV:GHSA-8FVV-FGR5-F8CH...

amoniak (1.0.2), aws-scripts (>=0.0.20, <=0.1.12) +7 more potentially affected by CVE-2026-88029 via pymongo (2.9.5)

pymongo PYPI version 2.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - amoniak 1.0.2 - aws-scripts =0.0.20, =0.4.2, =2.0.3, =0.1.3, =2.0.0, =2.3.0 Source cves: CVE-2026-88029 Source advisory: OSV:GHSA-8FVV-FGR5-F8CH...

CVE-2026-93393

A flaw was found in mongo-c-driver. A heap-based buffer overflow exists in the Transport Layer Security TLS transport layer when compiled with the Windows platform TLS backend. A remote server can exploit this flaw by sending crafted encrypted traffic after the TLS handshake completes, causing th...

CLEANSTART-2026-CA40991 mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS

CVE-2026-2303 affects multiple packages. The mongo-go-driver repository contains CGo bindings for GSSAPI Kerberos authentication on Linux and macOS. See references for individual vulnerability details...

alcali (>=2019.2.5, <=3000.1.0), deustest2022 (1.0.0) +6 more potentially affected by CVE-2026-15307 via django (3.0.5)

django PYPI version 3.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - alcali =2019.2.5, =0.2.32, =1.1.0, =8.2.0, =0.2.2, =0.9.9, =0.10.0 Source cves: CVE-2026-15307 Source advisory: OSV:PYSEC-2026-4035...