vantage6-node (3.8.4), vantage6-server (3.8.4) potentially affected by CVE-2026-73652 via vantage6 (3.8.4)

vantage6 PYPI version 3.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.8.4 - vantage6-server 3.8.4 Source cves: CVE-2026-73652 Source advisory: OSV:PYSEC-2026-3703...

vantage6-node (3.2.0rc2), vantage6-server (3.2.0rc2) potentially affected by CVE-2026-73652 via vantage6 (3.2.0rc2)

vantage6 PYPI version 3.2.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.2.0rc2 - vantage6-server 3.2.0rc2 Source cves: CVE-2026-73652 Source advisory: OSV:PYSEC-2026-3703...

vantage6-node (3.1.0rc7), vantage6-server (3.1.0rc7) potentially affected by CVE-2026-73652 via vantage6 (3.1.0rc7)

vantage6 PYPI version 3.1.0rc7 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.1.0rc7 - vantage6-server 3.1.0rc7 Source cves: CVE-2026-73652 Source advisory: OSV:PYSEC-2026-3703...

vantage6-algorithm-store (4.3.0b5), vantage6-node (4.3.0b5) +1 more potentially affected by CVE-2026-73652 via vantage6 (4.3.0b5)

vantage6 PYPI version 4.3.0b5 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.3.0b5 - vantage6-node 4.3.0b5 - vantage6-server 4.3.0b5 Source cves: CVE-2026-73652 Source advisory:...

Malicious code in mutex-core (npm)

Source: amazon-inspector 8c015af803d9d4adc7d0578dc27795ebaef48e6ce25e9bf715b54af1e4991999 The package is published under a name resembling the popular async-mutex library and, beyond advertised mutex functionality, contains a staged loader. lib/Mutex.js's Mutex.prototype.runExclusive checks wheth...

Malicious code in mutex-plus (npm)

Source: amazon-inspector a64e56572436d2ca889aa389887584bbeb3e67df09f30df6773cbfafc0188ca3 lib/Mutex.js contains a hidden branch inside runExclusive that, when a callback object carries a meta.jobId whose sha256 equals a hardcoded value...

Malicious code in matrixflow-js (npm)

Source: amazon-inspector 45393245d9a2fca558d1bcb8b7c9d5263c16ff63e9a038a51169b720c85e1352 [email protected] is a typosquat/repackage of ml-matrix the UMD global is mlMatrix; homepage matrixflow-js.github.io does not correspond to the real ml-matrix project. Its main module matrix.js routes...

BIT-ELASTICSEARCH-2026-72684 Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows an authenticated user holding only read privileges to submit a small search request containing a crafted user-supplied input. Processing that input causes a specific internal component to allocate memory without any upper bound, and the allocation occurs outside the...

Malicious code in gaarf-node (npm)

Source: amazon-inspector fc539c4e835f015b5f7b9e65ca33a720e44ee0191e3bbf422085949e5d3029b9 The package's postinstall script runs automatically on npm install and collects host identifiers os.hostname, platform, arch, node version, package name, npm lifecycle event and POSTs them as JSON to the...

Malicious code in gaarf-node-bq (npm)

Source: amazon-inspector 1f61e7b586146a833e50d74ccdff68942b4514f66c38beca981d2ead87761633 gaarf-node-bq is a dependency-confusion / typosquat canary targeting the internal google/ads-api-report-fetcher gaarf package. The bin entry is an empty noop and the package ships no real functionality. Its...

MAL-2026-14239 Malicious code in gaarf-node-bq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f61e7b586146a833e50d74ccdff68942b4514f66c38beca981d2ead87761633 gaarf-node-bq is a dependency-confusion / typosquat canary targeting the internal google/ads-api-report-fetcher gaarf package. The bin entry is an...

Malicious code in gaarf-node-bq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f61e7b586146a833e50d74ccdff68942b4514f66c38beca981d2ead87761633 gaarf-node-bq is a dependency-confusion / typosquat canary targeting the internal google/ads-api-report-fetcher gaarf package. The bin entry is an...

Malicious code in gaarf-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc539c4e835f015b5f7b9e65ca33a720e44ee0191e3bbf422085949e5d3029b9 The package's postinstall script runs automatically on npm install and collects host identifiers os.hostname, platform, arch, node version, package...

MAL-2026-14238 Malicious code in gaarf-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc539c4e835f015b5f7b9e65ca33a720e44ee0191e3bbf422085949e5d3029b9 The package's postinstall script runs automatically on npm install and collects host identifiers os.hostname, platform, arch, node version, package...

Malicious code in tailwind-utility-kit (npm)

Source: amazon-inspector 39d25399b925f6d37feda28b303576e2ad1672667a44ba9708f5e0ee213089ff The package is advertised as a Tailwind CSS utility library, but the default export assembles a URL from split fragments resolving to https://31.97.137.157:45000/icons/109, fetches JSON from that endpoint, a...

PT-2026-78423

Name of the Vulnerable Software and Affected Versions stigmem-node version 0.9.0a1 Description stigmem-node accepts federation peer key material during peer registration without requiring a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer...

PT-2026-78417

Name of the Vulnerable Software and Affected Versions stigmem-node versions prior to 0.9.0a12 Description A broken object level authorization BOLA flaw exists in the right-to-be-forgotten RTBF tombstone mechanism. The issue tombstone function defaulted the tenant to "default" instead of the...

CVE-2026-55090: Improper Neutralization of Input During Web Page Generation

Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value...

PT-2026-78425

stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation...

CVE-2026-46343: Improper Limitation of a Pathname to a Restricted Directory

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, WazuhCommon.endreceivingfile in framework/wazuh/core/cluster/common.py allows a cluster-authenticated node to delete files outside WAZUHPATH. A syniwme request wi...