606708 matches found
Malicious code in big-tss (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 022f32d17f1b3fa4c33727aa2309fe4e75706c842ac04b25a48738fdb9aa3d2b [email protected] impersonates the popular big.js arbitrary-precision math library and ships upstream big.js source with an injected block at the top of...
GHSA-VWF4-M7J8-WCJF vulnerabilities
Vulnerabilities for packages: metabase...
MAL-2026-13520 Malicious code in @aster110/cc2wechat (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a22dda7bf5c10da8b67b359d665b133709826bdebbd6632fc0fcf04551f1efac The package runs a daemon that long-polls Tencent's iLink Bot API ilinkai.weixin.qq.com for incoming WeChat messages and forwards each message body...
MAL-2026-13606 Malicious code in cdktn-provider-azurerm (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e Package name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm CDK for Terraform, with a single-character substitution cdktf →...
MAL-2026-13559 Malicious code in dolyame-ui-collapseblock (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef9992e81f3de4cb9bd4391466d7850e953c19a0772ebbe5992953044466377c On require, shim.js fetches an OS/architecture-specific native binary from hardcoded Cloudflare Workers hosts oob-worker.cf100-416.workers.dev,...
Malicious code in dolyame-ui-inputrange (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aae096235cf72db7f2e9908e53fa5a6e7c87718539a9e3452e0e34f7345ca80f On require of dolyame-ui-inputrange, init.js reconstructs a rotating list of Cloudflare Workers hostnames via split-string joins e.g...
ROOT-OS-ALPINE-323-CVE-2025-69649 CVE-2025-69649 in binutils - Patched by Root
Root has patched CVE-2025-69649 in the binutils package for Root:Alpine:3.23. Multiple fixed versions available...
ROOT-APP-MAVEN-GHSA-R7WM-3CXJ-WFF9 GHSA-r7wm-3cxj-wff9 in com.fasterxml.jackson.core:jackson-core - Patched by Root
Root has patched GHSA-r7wm-3cxj-wff9 in the com.fasterxml.jackson.core:jackson-core package for Root:Maven. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2026-1502 CVE-2026-1502 in python3.9 - Patched by Root
Root has patched CVE-2026-1502 in the python3.9 package for Root:Debian:11. Multiple fixed versions available...
ROOT-OS-DEBIAN-11-CVE-2026-15308 CVE-2026-15308 in python3.9 - Patched by Root
Root has patched CVE-2026-15308 in the python3.9 package for Root:Debian:11. Multiple fixed versions available...
CLSA-2026-1786096120 TuxCare security update for 4 packages (3 CVEs)
TuxCare rebuilt 4 packages to address 3 CVEs. Fixed in 9.0.83-tuxcare.4...
ROOT-APP-NPM-CVE-2025-5889 CVE-2025-5889 in brace-expansion - Patched by Root
Root has patched CVE-2025-5889 in the brace-expansion package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2023-26144 CVE-2023-26144 in graphql - Patched by Root
Root has patched CVE-2023-26144 in the graphql package for Root:npm. Multiple fixed versions available...
CVE-2026-56847 vulnerabilities
Vulnerabilities for packages: nodejs...
CVE-2026-41187 vulnerabilities
Vulnerabilities for packages: calico-fips...
pip absolute path traversal during download from malicious package indexes
...
CVE-2026-12261
A vulnerability in nltk.downloader in nltk/nltk versions = 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as corpora/ and taggers/ instead of package-isolated roots, and validates package integrity only after the...
Malicious code in fastapii (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf67e733322de0ce3d08269697e6ccd9460233319cadd5f97f05c8d1e855665a fastapii 0.1.2 is a single-character typosquat of the popular fastapi package. Its setup.py registers a custom setuptools install cmdclass LinuxInsta...