CVE-2026-11417-AWS-CDK-RCE

Inyección de Comandos en la Cadena de Suministro en NodejsFunction de AWS CDK CVE-2026-11417 Autor: Hesham Ashraf @HeshamASH Fecha: 10 de junio de 2026 Gravedad: Alta CVSSv3.1: 7.3, CVSSv4: 7.0 CWE: CWE-78 — Neutralización Incorrecta de Elementos Especiales utilizados en un Comando del SO Inyecci...

ROOT-APP-NPM-CVE-2025-13465 CVE-2025-13465 in lodash - Patched by Root

Root has patched CVE-2025-13465 in the lodash package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-HV7X-3X78-GX53 GHSA-hv7x-3x78-gx53 in n8n - Patched by Root

Root has patched GHSA-hv7x-3x78-gx53 in the n8n package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-54306 CVE-2026-54306 in n8n - Patched by Root

Root has patched CVE-2026-54306 in the n8n package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-54310 CVE-2026-54310 in n8n - Patched by Root

Root has patched CVE-2026-54310 in the n8n package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44789 CVE-2026-44789 in n8n - Patched by Root

Root has patched CVE-2026-44789 in the n8n package for Root:npm. Multiple fixed versions available...

@hatung/nx-nest-ddd (>=1.0.0, <=1.1.2), @naxodev/nx-cloudflare (>=5.0.0-rc.0, <=5.0.2) +8 more potentially affected by CVE-2026-104859 via @nx/docker (>=21.4.0, <=22.7.7)

@nx/docker NPM version =21.4.0, =1.0.0, =5.0.0-rc.0, =0.1.29, =0.2.3, =21.4.0-beta.4, =21.4.0-beta.4, =21.4.0-beta.4, =0.7.6, =0.0.3, =0.3.5 - @ziacik/azure-func 5.0.0 Source cves: CVE-2026-104859 Source advisory: OSV:GHSA-6VC5-VF29-FFR2...

@0xdeepak/wallets (0.0.2), @10xsai/cloudflare-router-nx-plugin (1.0.0) +1161 more potentially affected by CVE-2026-104854 via nx (>=14.6.0, <=22.7.8)

nx NPM version =14.6.0, =1.2.1, =2.0.0-beta.1, =2.0.0-beta.1, =2.0.0-beta.1, =2.0.0-beta.1, =2.2.1, =0.0.1, =0.0.1, =0.1.5, =0.1.8 and more Source cves: CVE-2026-104854 Source advisory: OSV:GHSA-W3VV-58GJ-GW77...

01basicreact (>=0.1.0, <=0.1.9), 10by10-react-app (1.2.1) +6200 more potentially affected by CVE-2026-87776 via compression (>=1.0.0, <=1.8.1)

compression NPM version =1.0.0, =0.1.0, =0.30.0, =4.11.0, =0.0.0-canary.0, =0.0.1, =2.0.1, =0.1.1, =1.0.0, =1.0.3 and more Source cves: CVE-2026-87776 Source advisory: OSV:GHSA-VC2V-76PW-4V95...

prosey

Prosey Prosey is a CLI tool to download and display video transcriptions from YouTube, so you can get the information you're looking for without wasting hours. The main use cases are: Summarize a YouTube video and display it in the CLI with a single command quicker. Read video captions, formatted...

opencode

El agente de programación con IA de código abierto. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt Instalación YOLO curl -fsSL...

CVE-2026-10053-lab

CVE-2026-10053 — reproducible verification lab Self-contained lab that proves the GitLab npm package-registry path traversal CVE-2026-10053 and shows it fixed, using a deterministic on-disk oracle — not HTTP status. What is and isn't proven. This lab proves authenticated arbitrary file write as...

Malicious code in tostpro (npm)

Source: amazon-inspector 2b31f6e946441400814984e1285717f9b2ee7fe5dacb7f0433f89396648a6183 The npm package [email protected] ships a preinstall lifecycle hook that invokes test.sh, which runs automatically on npm install. The script assembles the command curl and the data source env from single-lett...

MAL-2026-17559 Malicious code in hardhat-kex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8fa212654344b734814cee2291c9b9b91ecbc353bde5e83740624ee5f263c69 The npm package [email protected] ships an obfuscated 4.5MB single-line bundle at lib/config.js obfuscator.io-style string-array with a 26,234-entry...

Malicious code in tostpro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b31f6e946441400814984e1285717f9b2ee7fe5dacb7f0433f89396648a6183 The npm package [email protected] ships a preinstall lifecycle hook that invokes test.sh, which runs automatically on npm install. The script assembles...

Malicious code in hardhat-spack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e59c971c63de9d0a7f66c26093f528164990af10eca00a3a36b97d0c8b0a6d0d The package is published as hardhat-spack but presents itself internally as a pino-like logger. Its main export is a middleware factory that spawns...

CVE-2020-7598

es-define-property Object.defineProperty, but not IE 8's broken one. Example const assert = require'assert'; const $defineProperty = require'es-define-property'; if $defineProperty assert.equal$defineProperty, Object.defineProperty; else if Object.defineProperty assert.equal$defineProperty, false...

CVE-2026-92931: Server-Side Request Forgery (SSRF)

CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a remote attacker to make server-side requests to an attacker-controlled host, potentially exposing sensitive information...

CVE-2026-52617

CVE-2026-52617 — @sworddut/mcp-ffmpeg-helper: OS command injection via ffmpeg tool options runFFmpegCommand passes a string built from MCP tool parameters to spawn…, shell: true , so shell metacharacters in options, format, codec, pixelFormat or extraOptions execute on the host running the server...

MAL-2026-17493 Malicious code in @angularr/core (npm)

@angularr/[email protected] impersonates @angular/core by name only; its code is an unrelated library described as "Core Libs" and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...