MAL-2026-1244 Malicious code in spectral-corsair-navigator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4faab7d9e9e24067cf0a0ef23c529b2622cbb91b654a35430742ec584b827a54 The package spectral-corsair-navigator was found to contain malicious code. Source: ghsa-malware...

Important: Red Hat Security Advisory: Red Hat OpenShift GitOps v1.18.4 security update

Important: Red Hat OpenShift GitOps v1.18.4 security update An update is now available for Red Hat OpenShift GitOps. Bug Fixes and Enhancements: GITOPS-8439 CVE-2025-12816 openshift-gitops-1/console-plugin-rhel8: node-forge: Interpretation conflict vulnerability allows bypassing cryptographic...

tar has Hardlink Path Traversal via Drive-Relative Linkpath

Summary tar npm can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target such as C:../target.txt, which enables file overwrite outside cwd during normal tar.x extraction. Details The extraction logic in UnpackSTRIPABSOLUTEPATH chec...

Permissive List of Allowed Inputs

Overview @backstage/plugin-techdocs-node is a Common node.js functionalities for TechDocs, to be shared between techdocs-backend plugin and techdocs-cli Affected versions of this package are vulnerable to Permissive List of Allowed Inputs via the processing of the mkdocs.yml configuration file...

@backstage/plugin-search-backend-module-techdocs (>=0.4.11-next.0, <=0.4.11-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-20260123025240, <=2.1.5-next.2) +1 more potentially affected by CVE-2026-29186 via @backstage/plugin-techdocs-node (>=1.13.11-next.0, <=1.14.2-next.1)

@backstage/plugin-techdocs-node NPM version =1.13.11-next.0, =0.4.11-next.0, =0.0.0-nightly-20260123025240, =0.0.0-nightly-20260123025240, =1.10.5-next.1 Source cves: CVE-2026-29186 Source advisory: SNYK:JS-BACKSTAGEPLUGINTECHDOCSNODE-15426449...

@backstage/plugin-search-backend-module-techdocs (>=0.4.2-next.0, <=0.4.11-next.1), @backstage/plugin-techdocs-backend (>=0.0.0-nightly-2021111822616, <=2.1.5-next.2) +2 more potentially affected by CVE-2026-29186 via @backstage/plugin-techdocs-node (>=1.0.0, <=1.14.2-next.1)

@backstage/plugin-techdocs-node NPM version =1.0.0, =0.4.2-next.0, =0.0.0-nightly-2021111822616, =0.11.13, =0.0.0-nightly-2021111822616, =1.10.5-next.1 Source cves: CVE-2026-29186 Source advisory: OSV:GHSA-928R-FM4V-MVRW...

Important: nodejs22

Issue Overview: A vulnerability was found in juliangruber brace-expansion up to 1.1.11/2.0.1/3.0.0/4.0.0. It has been rated as problematic. Affected by this issue is the function expand of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant. Versions of OpenClaw prior to 2026.2.14 had security vulnerabilities. These vulnerabilities stemmed from the gateway not clearing the internal approval fields in the node.invoke parameters. This could allow attackers with valid gateway...

Important: nodejs20

Issue Overview: node-tar is a Tar for Node.js. The node-tar library = 7.5.2 fails to sanitize the linkpath of Link hardlink and SymbolicLink entries when preservePaths is false the default secure behavior. This allows malicious archives to bypass the extraction root restriction, leading to...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005678)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005678 advisory. In the Linux kernel, the following vulnerability has been resolved: software node: Correct a OOB check in softwarenodegetreferenceargs softwarenodegetreferenceargs...

Important: nodejs24

Issue Overview: node-tar is a Tar for Node.js. The node-tar library = 7.5.2 fails to sanitize the linkpath of Link hardlink and SymbolicLink entries when preservePaths is false the default secure behavior. This allows malicious archives to bypass the extraction root restriction, leading to...

GHSA-XPQW-6GX7-V673 SVGO DoS through entity expansion in DOCTYPE (Billion Laughs)

Summary SVGO accepts XML with custom entities, without guards against entity expansion or recursion. This can result in a small XML file 811 bytes stalling the application and even crashing the Node.js process with JavaScript heap out of memory. Details The upstream XML parser sax doesn't interpr...

Improper Handling of URL Encoding (Hex Encoding)

Overview @hono/node-server is a Node.js Adapter for Hono Affected versions of this package are vulnerable to Improper Handling of URL Encoding Hex Encoding via inconsistent URL decoding between the serveStatic process and route-based middleware protections. An attacker can access protected static...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @agimon-ai/browse-tool (>=0.2.0, <=0.5.5) +224 more potentially affected by CVE-2026-29087 via @hono/node-server (>=1.0.2, <=1.19.9)

@hono/node-server NPM version =1.0.2, =0.1.8-fix.3, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =1.0.25-beta.0, =0.0.1, =0.0.1-experimental.1, =0.1.0, =0.3.4 - @babybase/ui 0.2.0 and more Source cves: CVE-2026-29087 Source advisory: OSV:GHSA-WC8C-QW6V-H7F6...

@hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

Summary When using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes %2F may be...

@3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5), @agimon-ai/browse-tool (>=0.2.0, <=0.5.5) +224 more potentially affected by CVE-2026-29087 via @hono/node-server (>=1.0.2, <=1.19.9)

@hono/node-server NPM version =1.0.2, =0.1.8-fix.3, =0.2.0, =0.2.0, =0.4.0, =0.2.0, =1.0.2, =2.0.0-beta.66, =2.0.0-beta.66, =1.0.25-beta.0, =0.0.1, =0.0.1-experimental.1, =0.1.0, =0.3.4 - @babybase/ui 0.2.0 and more Source cves: CVE-2026-29087 Source advisory: SNYK:JS-HONONODESERVER-15425963...

GHSA-WC8C-QW6V-H7F6 @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware

Summary When using @hono/node-server's static file serving together with route-based middleware protections e.g. protecting /admin/, inconsistent URL decoding can allow protected static resources to be accessed without authorization. In particular, paths containing encoded slashes %2F may be...

CVE-2026-23812 Security Boundary Bypass via Routing Node Impersonation

A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leveraging an address-based spoofing technique. Successful exploitation enables the redirection of data streams, allowing for the interception or...

CVE-2026-23812

Technical details (vulnerable products, affected versions, or exploit specifics) are not publicly available in the provided documents. Monitor for updates from NVD/Red Hat/ENISA and vendor advisories.

CVE-2026-23812 Security Boundary Bypass via Routing Node Impersonation

A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leveraging an address-based spoofing technique. Successful exploitation enables the redirection of data streams, allowing for the interception or...