2325 matches found
CVE-2026-73416
This CVE affects JupyterLab (PyPI extension manager) where the blocked_extensions_uris check uses a weaker-than-PyPI normalization, allowing an authenticated user to bypass the blocklist by using a PyPI-equivalent spelling (e.g., JupyterLab.Git for jupyterlab-git). Versions 4.5.0–4.5.10 and 4.6.2...
CVE-2026-59948
A flaw was found in Composer, a dependency manager for the PHP language. A remote attacker could exploit this vulnerability by providing a maliciously crafted package from an untrusted source. During installation or update, Composer's improper validation of package names allows it to write...
SUSE-SU-2026:3283-1 Security update for perl-DBI
This update for perl-DBI fixes the following issues - CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution bsc1271018. - CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a proce...
JupyterLab: PyPI extension blocklist package-name canonicalization bypass
JupyterLab's PyPI extension manager enforces blockedextensionsuris by comparing the requested install name to blocklist entries with a custom string normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as...
Composer: Arbitrary file write outside vendor via malicious transitive package name
Summary A maliciously crafted package, published on an untrusted third party repository other than Packagist.org or Private Packagist, can cause Composer to write files outside the vendor/ directory and outside your project, with attacker-controlled content, during a normal install or update...
MAL-2026-10910 Malicious code in mysupergoodpython (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-10907 Malicious code in hello-world-test-mh2 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68a70ea37beb115e4464b5e9ebaf58986f4cd75434257163f4ddb82f5624ea13 setup.py decodes a base64 string and passes the result to exec at install time. The decoded payload is a single print statement that emits a benign...
MAL-2026-10860 Malicious code in @gocortexio/npmgremlinbox-ucl-1-0 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58e0b7489bb5ef9967ddda5eb651a0a399c73ae03e692909f34f864b189bde46 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-10807 Malicious code in @gocortexio/npmgremlinbox-cc-by-sa-3-0-at (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a567f9fda6a70475cc32be7b5392bbc1a3c1787b8323c1ff2bc6c237e198fdc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-10606 Malicious code in base58-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba5517883cb10a7c76e95fdf21a4ffce21c13fe1ca42fafc13f5adb021599772 The package's index.js contains multiple Buffer.from... decode sites lines 7, 29, 34, 49, 50 used to reconstruct strings/payloads at runtime — the...
BIT-COMPOSER-2026-59948 Composer: Arbitrary file write outside vendor via malicious transitive package name
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project...
MAL-2026-10126 Malicious code in dowload_ebok_wrath_of_the_gods_by_j_robert_kennedy_61o88 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e394751a822cba7556f9b6676b531a472c7c113da4458970b242b42df9d88e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
SUSE CVE-2026-59948
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project...
CVE-2026-59948
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project...
CVE-2026-59948
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project...
CVE-2026-59948 Composer: Arbitrary file write outside vendor via malicious transitive package name
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project...
CVE-2026-59948
Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Composer to write attacker-controlled files outside the vendor directory and outside the project...
MAL-2026-7430 Malicious code in ureactjs (npm)
--- -= Per source details. Do not edit below this line.=-...