196805 matches found
Directory Traversal
Overview org.webjars.npm:extract-zip is an unzip a zip file into a directory using 100% javascript Affected versions of this package are vulnerable to Directory Traversal through the archive extraction logic in index.js. An attacker can write a file outside the destination directory by supplying ...
CVE-2026-40345
creationtimestamp| type| source ---|---|--- 2026-08-17 14:35:03+00:00| published-proof-of-concept| https://github.com/RebeccaStevens/deepmerge-ts/security/advisories/GHSA-ggr8-5vv4-36mx 2026-08-17 18:00:03+00:00| seen| Telegram/S7eqLraqEg6Kwu3Kw8cANfzCQgkQhswVCeNeKxsnaOowjNQ 2026-08-18...
Malicious code in club-sauce (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a5b5234f79f70ac18cfbd80c2e2cf922e3f151b38d807627feb087a35f7c645 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-14107 Malicious code in club-sauce (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a5b5234f79f70ac18cfbd80c2e2cf922e3f151b38d807627feb087a35f7c645 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
@availhealth/bot-layer (0.1.4), @fuego-systems/core (>=0.1.8, <=0.2.0) +9 more potentially affected by CVE-2026-53728 via @medplum/core (>=5.0.0, <=5.1.5)
@medplum/core NPM version =5.0.0, =0.1.8, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.10, =5.1.5 Source cves: CVE-2026-53728 Source advisory: OSV:GHSA-M44R-7C5H-M6MJ...
NPM: DeepmergeTS has stack exhaustion when merging recursive object graphs
NPM: DeepmergeTS has stack exhaustion when merging recursive object graphs vulnerability discovered by ? in WordPress Npm deepmerge-ts versions 8.0.0...
CVE-2026-19693 extract-zip arbitrary file write outside the destination directory via a symlink at the final path component
extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through t...
CVE-2026-19693 extract-zip arbitrary file write outside the destination directory via a symlink at the final path component
extract-zip through 2.0.1 containment-checks only the parent directory of each archive entry and never the entry's own final path component, so an archive containing two entries with identical names - a symlink whose target is outside the destination, followed by a regular file - writes through t...
Malicious code in sugarball-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e600e0ab4f99d726e508d2ad82425ab2bc06f141c333dfecf0bdba9edd66f6d3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-14111 Malicious code in sugarball-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e600e0ab4f99d726e508d2ad82425ab2bc06f141c333dfecf0bdba9edd66f6d3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
ROOT-APP-NPM-CVE-2021-3807 CVE-2021-3807 in ansi-regex - Patched by Root
Root has patched CVE-2021-3807 in the ansi-regex package for Root:npm. Multiple fixed versions available...
MAL-2026-14106 Malicious code in cloud-agen-bot (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e57cfebf30bc4f71b96f08b04b1d0b7a0af0a7f32d11033a2c186e7692333e notify.js exports send, sendFile, sendPhoto, and log helpers that POST caller-supplied content to api.telegram.org using a hardcoded bot token and a...
Malicious code in cloud-agen-bot (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3e57cfebf30bc4f71b96f08b04b1d0b7a0af0a7f32d11033a2c186e7692333e notify.js exports send, sendFile, sendPhoto, and log helpers that POST caller-supplied content to api.telegram.org using a hardcoded bot token and a...
Malicious code in a.poltoradnev-package-a (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13d1659d9d1386305bd1c623cc2e3643375f4e14ad279ece4f3df684ecd53ab5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-14103 Malicious code in a.poltoradnev-package-a (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13d1659d9d1386305bd1c623cc2e3643375f4e14ad279ece4f3df684ecd53ab5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-14102 Malicious code in @siwatfa/yorn (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a80ba4dd71c991ac9dfc64dd9954a5ad7a83d2b67cc7807dde863872f9324b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious code in @siwatfa/yorn (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95a80ba4dd71c991ac9dfc64dd9954a5ad7a83d2b67cc7807dde863872f9324b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
ip-address: ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass
A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...