266032 matches found
CVE-2026-104077
Obsidian Desktop versions before 1.14.0 are vulnerable to Remote Code Execution (RCE) via the Slides core plugin . The root cause is insufficient sanitization of the data-background-iframe attribute in Markdown notes, which allows attackers to bypass DOMPurify . This vulnerability is exploited wh...
ROOT-APP-NPM-CVE-2026-44902 CVE-2026-44902 in @opentelemetry/auto-instrumentations-node - Patched by Root
Root has patched CVE-2026-44902 in the @opentelemetry/auto-instrumentations-node package for Root:npm. Multiple fixed versions available...
MAL-2026-17684 Malicious code in node-gyp-runtime (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcec19492c8bdcd8c866d1aad1a2b8a253d7d9bbc8184ff182af71a75ce56589 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17683 Malicious code in node-fetch-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e96b428b5de9465675c8a84b41aef8afbb1f4b62ab7ef7fb437bb53692095e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17681 Malicious code in node-env-resolve (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f3e0e1b364a3d74534d6ce1eca74778a85e508cf10952f84f36bf1badd8a581 The package is advertised as an environment configuration resolver but its postinstall script installs a hidden persistent agent into user-level...
Malicious code in node-env-resolve (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f3e0e1b364a3d74534d6ce1eca74778a85e508cf10952f84f36bf1badd8a581 The package is advertised as an environment configuration resolver but its postinstall script installs a hidden persistent agent into user-level...
CLSA-2026-1791467333 TuxCare security update for node-forge (3 CVEs)
TuxCare rebuilt node-forge to address 3 CVEs. Fixed in 1.3.3-tuxcare.2...
@corexium/xbails (0.0.7), @synergyxd/baileys (0.0.3) potentially affected by unknown CVE via @bellaxchuu/libsignal-node (0.0.1-security)
@bellaxchuu/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @bellaxchuu/libsignal-node and may be impacted: - @corexium/xbails 0.0.7 - @synergyxd/baileys 0.0.3 Source cves: unknown CVE Source advisory:...
@corexium/xbails (0.0.7), @synergyxd/baileys (0.0.3) potentially affected by unknown CVE via @bellaxchuu/libsignal-node (0.0.1-security)
@bellaxchuu/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @bellaxchuu/libsignal-node and may be impacted: - @corexium/xbails 0.0.7 - @synergyxd/baileys 0.0.3 Source cves: unknown CVE Source advisory:...
MAL-2026-17676 Malicious code in @bellaxchuu/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69f70788aeca5b98fbe0c721d7f6a88c036d661c3f0132443a6bdb97080f5819 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-17672 Malicious code in @xayz/libsignal-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a9744aa6c5f3c994e66b4847aba63d6cf1503583f0a23185c67bb32b7394e77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
ROOT-APP-NPM-CVE-2026-22029 CVE-2026-22029 in @remix-run/router - Patched by Root
Root has patched CVE-2026-22029 in the @remix-run/router package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2025-64718 CVE-2025-64718 in js-yaml - Patched by Root
Root has patched CVE-2025-64718 in the js-yaml package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-44003 CVE-2026-44003 in vm2 - Patched by Root
Root has patched CVE-2026-44003 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-44005 CVE-2026-44005 in vm2 - Patched by Root
Root has patched CVE-2026-44005 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-24118 CVE-2026-24118 in vm2 - Patched by Root
Root has patched CVE-2026-24118 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-43998 CVE-2026-43998 in vm2 - Patched by Root
Root has patched CVE-2026-43998 in the vm2 package for Root:npm. Multiple fixed versions available...
@corexium/xbails (0.0.7), @synergyxd/baileys (0.0.3) potentially affected by unknown CVE via @bellaxchuu/libsignal-node (0.0.1-security)
@bellaxchuu/libsignal-node NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on @bellaxchuu/libsignal-node and may be impacted: - @corexium/xbails 0.0.7 - @synergyxd/baileys 0.0.3 Source cves: unknown CVE Source advisory:...
Malicious Package
Overview @bellaxchuu/libsignal-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Malicious Package
Overview node-env-resolve is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...