2263 matches found
MAL-2026-291 Malicious code in lead-ion (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73b94952b37be8de5cd4b876f8a727522e99b0ecec9833bdbc5d1317ecea3ba3 The package lead-ion was found to contain malicious code. Source: ghsa-malware 869120ab1d13a2e9efe9b9341ed9c11c2713a91661a59d52a32771e69f6bb4a4 Any...
MiracleLinux 4 : cvs-1.11.23-11.1.0.1.AXS4 (AXSA:2012-238:01)
The remote MiracleLinux 4 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2012-238:01 advisory. CVS Concurrent Versions System is a version control system that can record the history of your files usually, but not always, source code. CVS only stores the...
EUVD-2026-2410
Malicious code in chai-as-enhanced npm...
MiracleLinux 7 : mpfr-3.1.1-4.0.1.el7.AXS7 (AXSA:2025-10890:01)
The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-10890:01 advisory. CVE-2014-9474: Fix of a buffer overflow due to incorrect GMP documentation for mpnsetstr CVEs: CVE-2014-9474 Buffer overflow in the mpfrstrtofr function in...
CVE-2020-7629
install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...
CVE-2018-14040 vulnerabilities
Vulnerabilities for packages: grafana, grafana-fips...
Atlassian Confluence < 9.2.6 / 9.3.x < 9.4.0 / < 9.4.0 / 9.5.x < 9.5.2 / 10.0.x < 10.0.2 / 10.1.0 (CONFSERVER-101488)
The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-101488 advisory. - The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses such as 0x7f.1 are improperly categorized as globally routable...
expr-eval: expr-eval: Prototype Pollution
A prototype pollution flaw was found in expr-eval. An attacker with access to express eval interface can use JavaScript prototype-based inheritance model to achieve arbitrary code execution...
EUVD-2026-0730
Malicious code in tickncook-robot npm...
Malicious code in sturdyfetch21 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ba69196889e05381da2622501c31fa4d044353988973b496b124beccb6f8466 The package sturdyfetch21 was found to contain malicious code...
@amazeelabs/bridge-waku (>=1.1.0, <=2.0.1), @amazeelabs/executors (>=3.0.0, <=3.1.14) +52 more potentially affected by CVE-2025-55184 via react-server-dom-webpack (>=19.0.0, <=19.0.1)
react-server-dom-webpack NPM version =19.0.0, =1.1.0, =3.0.0, =1.1.0, =1.1.0, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.9.1-next.19, =1.0.0-canary.12245, =1.0.0-canary.12245, =0.0.4, =2.0.3-next.0 an...
EUVD-2025-201910
Malicious code in chai-uuids npm...
CVE-2020-7973 vulnerabilities
Vulnerabilities for packages: gitlab-operator-fips...
EUVD-2025-201390
Malicious code in dotnetenv npm...
EUVD-2025-201086
Malicious code in elf-stats-caroling-mailbag-397 npm...
Arbitrary Code Injection
Overview react-server-dom-turbopack is a React Server Components bindings for DOM using Turbopack. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Arbitrary Code Injection via unsafe...
EUVD-2025-200905
Malicious code in elf-stats-fuzzy-ornament-236 npm...
MAL-2025-192117 Malicious code in elf-stats-piney-icicle-501 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50a81a39f19f3396146e10e967bf8fc434051ecba699f80b5292cba89921d877 The package elf-stats-piney-icicle-501 was found to contain malicious code. Source: ghsa-malware...