MAL-2026-16058 Malicious code in vinzz-wcli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dec0212466f7170f1e00ecbfe3f846cbf5d211917c3831a6ee162ca6d44ec10 vinzz-wcli is a WhatsApp CLI whose main entry index.js sets global.ownerr = "[email protected]" and treats any incoming WhatsApp message...

MAL-2026-16057 Malicious code in toru-ultimate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6ef8cb6f3ca866b67fa91f2e770c674ddb7d6b110fd671ba98669dc1220510f The package's loginViaAPI function POSTs caller-supplied Facebook email, password, and 2FA Base32 secret to...

Malicious code in toru-ultimate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6ef8cb6f3ca866b67fa91f2e770c674ddb7d6b110fd671ba98669dc1220510f The package's loginViaAPI function POSTs caller-supplied Facebook email, password, and 2FA Base32 secret to...

MAL-2026-16056 Malicious code in tailwind-aspect-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d63fe1e50dc7d704732a5e92e95f320fcc3fac45c5a0a223ed278f316c2bb14 The package's main module src/index.js performs an https.get to http://23.27.245.100/index.js over plain HTTP, writes the response to./inout.js in th...

CVE-2026-85504 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85504 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-74994 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-74994 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

CVE-2026-71562 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-71562 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

CVE-2026-66357 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-66357 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

CVE-2026-85506 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85506 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-85508 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85508 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-73812 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-73812 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

CVE-2026-66835 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-66835 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

CVE-2026-63076 affecting package edk2 for versions less than 20240524git3e722403cd16-19

CVE-2026-63076 affecting package edk2 for versions less than 20240524git3e722403cd16-19. A patched version of the package is available...

CVE-2026-85507 affecting package freeipmi for versions less than 1.6.19-1

CVE-2026-85507 affecting package freeipmi for versions less than 1.6.19-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-69664 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-69664 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

CVE-2026-73276 affecting package erlang for versions less than 26.2.5.21-6

CVE-2026-73276 affecting package erlang for versions less than 26.2.5.21-6. A patched version of the package is available...

NPM: n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy

NPM: n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy vulnerability discovered by ? in WordPress Npm n8n versions 2.37.7...

4591-libs (>=0.0.1, <=0.2.0), @10abdullahbutt/nestjs-boilerplate (0.0.1) +1565 more potentially affected by CVE-2026-77063 via multer (>=2.0.0-alpha.2, <=2.2.0)

multer NPM version =2.0.0-alpha.2, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.1, =1.0.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.0.2, =0.0.10, =1.0.0, =0.0.3, =0.0.8 and more Source cves: CVE-2026-77063 Source advisory: GHSA-QVFW-J98X-7Q72...

NPM: multer vulnerable to Denial of Service via oversized array index in field names

NPM: multer vulnerable to Denial of Service via oversized array index in field names vulnerability discovered by ? in WordPress Npm multer versions 2.3.0...

NPM: morgan vulnerable to Log Forging via unescaped Unicode line separators

NPM: morgan vulnerable to Log Forging via unescaped Unicode line separators vulnerability discovered by ? in WordPress Npm morgan versions 1.12.0...