143357 matches found
ROOT-APP-NPM-AIKIDO-2026-10844 AIKIDO-2026-10844 in vm2 - Patched by Root
Root has patched AIKIDO-2026-10844 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-10841 AIKIDO-2026-10841 in vm2 - Patched by Root
Root has patched AIKIDO-2026-10841 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-44009 CVE-2026-44009 in vm2 - Patched by Root
Root has patched CVE-2026-44009 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-24118 CVE-2026-24118 in vm2 - Patched by Root
Root has patched CVE-2026-24118 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-53655 CVE-2026-53655 in tar - Patched by Root
Root has patched CVE-2026-53655 in the tar package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-59875 CVE-2026-59875 in tar - Patched by Root
Root has patched CVE-2026-59875 in the tar package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-9679 CVE-2026-9679 in undici - Patched by Root
Root has patched CVE-2026-9679 in the undici package for Root:npm. Multiple fixed versions available...
7ghost (>=4.11.0, <=4.11.46), @21epub/text-block (>=0.0.1, <=1.2.1) +2064 more potentially affected by CVE-2026-63670 via sanitize-html (>=2.1.0, <=2.17.5)
sanitize-html NPM version =2.1.0, =4.11.0, =0.0.1, =5.0.2, =0.0.1, =1.0.0, =3.0.0, =1.3.0, =1.0.0, =1.38.0, =1.3.2, =1.7.1 and more Source cves: CVE-2026-63670 Source advisory: OSV:GHSA-JXWJ-J7WR-GFRW...
ROOT-APP-NPM-CVE-2026-25896 CVE-2026-25896 in fast-xml-parser - Patched by Root
Root has patched CVE-2026-25896 in the fast-xml-parser package for Root:npm. Multiple fixed versions available...
EUVD-2026-68816
pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph...
@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +12 more potentially affected by CVE-2026-82393 via pnpm (>=10.0.0, <=10.33.2)
pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-82393 Source advisory: OSV:GHSA-VQ4V-J7R6-JQ4M...
EUVD-2026-68883
pnpm: A tarball dependency's manifest name escapes nodemodules → arbitrary file write/overwrite on install...
@forgeax/game (>=0.3.0, <=0.3.4), @huiliyi37/cordis-plugin-loader (>=0.2.0, <=0.8.0) +7 more potentially affected by CVE-2026-82393 via pnpm (>=11.5.3, <=11.7.0)
pnpm NPM version =11.5.3, =0.3.0, =0.2.0, =0.2.4, =0.1.2, =0.1.13, =2.2.0, =2.2.12 Source cves: CVE-2026-82393 Source advisory: OSV:GHSA-VQ4V-J7R6-JQ4M...
ROOT-APP-NPM-CVE-2026-27606 CVE-2026-27606 in rollup - Patched by Root
Root has patched CVE-2026-27606 in the rollup package for Root:npm. Multiple fixed versions available...
@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +9 more potentially affected by unknown CVE via pnpm (>=10.8.1, <=10.33.2)
pnpm NPM version =10.8.1, =0.1.0, =1.1.1, =0.1.0-beta.3, =0.1.8, =0.1.0, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: unknown CVE Source advisory: OSV:GHSA-VX52-2968-3VC6...
ROOT-APP-NPM-CVE-2026-29786 CVE-2026-29786 in tar - Patched by Root
Root has patched CVE-2026-29786 in the tar package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-23745 CVE-2026-23745 in tar - Patched by Root
Root has patched CVE-2026-23745 in the tar package for Root:npm. Multiple fixed versions available...
CVE-2026-82393
pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name...