Inappropriate Encoding for Output Context

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Inappropriate Encoding for Output Context in the mailto parser when handling percent-encoded query field names. An attacker can manipulate email recipients, subjects, or body content by...

ROOT-APP-NPM-CVE-2026-59725 CVE-2026-59725 in engine.io - Patched by Root

Root has patched CVE-2026-59725 in the engine.io package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-59880 CVE-2026-59880 in immutable - Patched by Root

Root has patched CVE-2026-59880 in the immutable package for Root:npm. Multiple fixed versions available...

Directory Traversal

Overview org.webjars.npm:moment is a lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of this package are vulnerable to Directory Traversal in the locale function, whose locale name validation is circumvented by a non-string value,...

DEBIAN-CVE-2026-17495

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

CVE-2026-17495

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

UBUNTU-CVE-2026-17495

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

ROOT-APP-NPM-CVE-2026-45623 CVE-2026-45623 in postcss - Patched by Root

Root has patched CVE-2026-45623 in the postcss package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-73646 CVE-2026-73646 in postcss - Patched by Root

Root has patched CVE-2026-73646 in the postcss package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-50272 CVE-2026-50272 in dd-trace - Patched by Root

Root has patched CVE-2026-50272 in the dd-trace package for Root:npm. Multiple fixed versions available...

CVE-2026-17495 moment vulnerable to Path Traversal via crafted non-string locale name

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

CVE-2026-17495

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

CVE-2026-17495

moment (a JavaScript date library) versions 2.29.2 through 2.30.1 are vulnerable to a path traversal via a specially crafted non-string object passed to moment.locale(). The guard assumes string input, so an object whose match() method satisfies the check while toString() returns a traversal path...

EUVD-2026-78277

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object...

ROOT-APP-NPM-CVE-2024-45590 CVE-2024-45590 in body-parser - Patched by Root

Root has patched CVE-2024-45590 in the body-parser package for Root:npm. Multiple fixed versions available...

CLEANSTART-2026-RA54974 undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers

Multiple security vulnerabilities affect the npm package. undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while still presenting the original response's status and headers. See references for individual...

Linux Distros Unpatched Vulnerability : CVE-2026-17495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-stri...

Malicious code in n8n-nodes-sysdiag2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cde3a20bc24f39c8a55a9f700f50c39dd42cbbab51c57ddf9fbbb54307ee7a8 The package advertises itself as an n8n community node for system diagnostics, but the shipped node module dist/SysDiag.node.js is an inert stub...

MAL-2026-16162 Malicious code in n8n-nodes-sysdiag2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7cde3a20bc24f39c8a55a9f700f50c39dd42cbbab51c57ddf9fbbb54307ee7a8 The package advertises itself as an n8n community node for system diagnostics, but the shipped node module dist/SysDiag.node.js is an inert stub...

MAL-2026-16158 Malicious code in afhmxiewpsf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16474deee8d099601d63dabfa432a6f9875447b16c1472763ce04fcd8a97c79 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...