NPM: xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` adjacent-text merge

NPM: xmldom: Quadratic-time parsing via the malformed-input recovery path — parseElementStartPart re-scan and normalize adjacent-text merge vulnerability discovered by ? in WordPress Npm xmldom versions = 0.3.0, = 0.6.0...

NPM: joi: Prototype pollution via a `__proto__` language key in custom messages

NPM: joi: Prototype pollution via a proto language key in custom messages vulnerability discovered by ? in WordPress Npm joi versions = 17.2.0, 17.13.6...

NPM: Colord: Slow rejection of oversized malformed color strings

NPM: Colord: Slow rejection of oversized malformed color strings vulnerability discovered by ? in WordPress Npm colord versions 2.9.4...

NPM: joi: object().rename() with a template target can set the validated object's prototype

NPM: joi: object.rename with a template target can set the validated object's prototype vulnerability discovered by ? in WordPress Npm joi versions = 16.0.0, 17.13.5...

NPM: xmldom: Element name injection via createElement() bypasses requireWellFormed

NPM: xmldom: Element name injection via createElement bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...

NPM: xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

NPM: xmldom: Attribute name injection via setAttribute bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...

Malicious code in punypump (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e56cc14096d20f679823bf15af9f44dff039e01f23d2082eba8020200d04a7f The package presents itself as a console shim index.js is a verbatim copy of console-browserify with description 'Emulate console for all the...

MAL-2026-16048 Malicious code in punypump (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e56cc14096d20f679823bf15af9f44dff039e01f23d2082eba8020200d04a7f The package presents itself as a console shim index.js is a verbatim copy of console-browserify with description 'Emulate console for all the...

Security Bulletin: Multiple vulnerabilities addressed in IBM SevOne Network Performance Management for August 2026

Summary IBM SevOne Network Performance Management has addressed these security vulnerabilities in the SD-WAN component with a Service Pack update. The publication of this security bulletin represents a change in our communication process, not an increase in security vulnerabilities. IBM SevOne...

ROOT-APP-NPM-CVE-2026-59871 CVE-2026-59871 in tar - Patched by Root

Root has patched CVE-2026-59871 in the tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-59873 CVE-2026-59873 in tar - Patched by Root

Root has patched CVE-2026-59873 in the tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-12151 CVE-2026-12151 in undici - Patched by Root

Root has patched CVE-2026-12151 in the undici package for Root:npm. Multiple fixed versions available...

Malicious code in i18nexus-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 558344f06c374c5eff9c870250d63a5e9f784ffe23f91182154d9c66c441ee0b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in i18nexus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37d8dfb4ceaec110414441ebad5da37dad342ef653a20499504385d9db1ffdac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16046 Malicious code in i18nexus-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 558344f06c374c5eff9c870250d63a5e9f784ffe23f91182154d9c66c441ee0b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @web2apk/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ad4c3329ebb2fdeb3b9ddc93abcb5f3dab6773f7a7999ff96d063d49edc04d9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16043 Malicious code in @web2apk/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ad4c3329ebb2fdeb3b9ddc93abcb5f3dab6773f7a7999ff96d063d49edc04d9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16042 Malicious code in krdpass-auth-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a74ab9e45d4f67b40e21dc7491aff1979b4bf79be24bc49b8588916c18b847f package.json declares a preinstall script preinstall.js that runs automatically on npm install. The script collects os.hostname, os.userInfo, homedir...

Malicious code in krdpass-auth-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a74ab9e45d4f67b40e21dc7491aff1979b4bf79be24bc49b8588916c18b847f package.json declares a preinstall script preinstall.js that runs automatically on npm install. The script collects os.hostname, os.userInfo, homedir...

Malicious code in plogme (npm)

plogme is a renamed fork of the Baileys WhatsApp Web library from the same publisher-controlled family as @crysnovax/baileys MAL-2026-15917, and versions 1.0.0 through 1.0.3 carry the same forced-follow and fingerprint modules. lib/Utils/channel-policy.js javascript-obfuscator output, identical t...