MAL-2026-16056 Malicious code in tailwind-aspect-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d63fe1e50dc7d704732a5e92e95f320fcc3fac45c5a0a223ed278f316c2bb14 The package's main module src/index.js performs an https.get to http://23.27.245.100/index.js over plain HTTP, writes the response to./inout.js in th...

CVE-2026-85506 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85506 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-85504 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85504 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-69664 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-69664 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

CVE-2026-73276 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-73276 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

CVE-2026-63076 affecting package edk2 for versions less than 20240524git3e722403cd16-19

CVE-2026-63076 affecting package edk2 for versions less than 20240524git3e722403cd16-19. A patched version of the package is available...

CVE-2026-85508 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85508 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-74994 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-74994 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

CVE-2026-71562 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-71562 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

CVE-2026-85507 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85507 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-73812 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-73812 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

CVE-2026-66835 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-66835 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

CVE-2026-66357 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-66357 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

NPM: n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy

NPM: n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy vulnerability discovered by ? in WordPress Npm n8n versions 2.37.7...

4591-libs (>=0.0.1, <=0.2.0), @10abdullahbutt/nestjs-boilerplate (0.0.1) +1565 more potentially affected by CVE-2026-77063 via multer (>=2.0.0-alpha.2, <=2.2.0)

multer NPM version =2.0.0-alpha.2, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.1, =1.0.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.0.2, =0.0.10, =1.0.0, =0.0.3, =0.0.8 and more Source cves: CVE-2026-77063 Source advisory: GHSA-QVFW-J98X-7Q72...

NPM: multer vulnerable to Denial of Service via oversized array index in field names

NPM: multer vulnerable to Denial of Service via oversized array index in field names vulnerability discovered by ? in WordPress Npm multer versions 2.3.0...

NPM: morgan vulnerable to Log Forging via unescaped Unicode line separators

NPM: morgan vulnerable to Log Forging via unescaped Unicode line separators vulnerability discovered by ? in WordPress Npm morgan versions 1.12.0...

@regis-samurai/n8n (>=0.216.1, <=0.219.1), n8n-nodes-accelo (>=0.1.0, <=0.1.9) +11 more potentially affected by CVE-2026-86077 via n8n (>=0.81.0, <=0.219.1)

n8n NPM version =0.81.0, =0.216.1, =0.1.0, =0.18.0, =0.1.0, =0.1.0, =0.2.14, =0.1.0, =0.1.0, =0.0.2, =0.0.2, =1.1.3 Source cves: CVE-2026-86077 Source advisory: MEND:CVE-2026-86077...

NPM: Astro: Remote code execution through AVIF image optimization

NPM: Astro: Remote code execution through AVIF image optimization vulnerability discovered by ? in WordPress Npm astro versions 7.2.8...

Composer arbitrary command execution via a malicious package's Perforce source URL

Summary If the p4 Perforce CLI client is installed, a malicious dependency package from a package repository allowing arbitrary perforce source URLs packagist.org is safe could execute arbitrary commands when running composer install or composer update. Composer passed a package's Perforce source...