630096 matches found
NPM: Astro: Remote code execution through AVIF image optimization
NPM: Astro: Remote code execution through AVIF image optimization vulnerability discovered by ? in WordPress Npm astro versions 7.2.8...
Composer arbitrary command execution via a malicious package's Perforce source URL
Summary If the p4 Perforce CLI client is installed, a malicious dependency package from a package repository allowing arbitrary perforce source URLs packagist.org is safe could execute arbitrary commands when running composer install or composer update. Composer passed a package's Perforce source...
GHSA-RVX4-FFVW-M9Q3 Composer arbitrary command execution via a malicious package's Perforce source URL
Summary If the p4 Perforce CLI client is installed, a malicious dependency package from a package repository allowing arbitrary perforce source URLs packagist.org is safe could execute arbitrary commands when running composer install or composer update. Composer passed a package's Perforce source...
NPM: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
NPM: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials vulnerability discovered by ? in WordPress Npm hono versions 4.13.5...
NPM: SVGO: removeScripts allows executable links through namespace and control-character bypasses
NPM: SVGO: removeScripts allows executable links through namespace and control-character bypasses vulnerability discovered by ? in WordPress Npm svgo versions = 1.0.0, 2.8.4...
@regis-samurai/n8n (>=0.216.1, <=0.219.1), n8n-nodes-accelo (>=0.1.0, <=0.1.9) +11 more potentially affected by CVE-2026-86994 via n8n (>=0.81.0, <=0.219.1)
n8n NPM version =0.81.0, =0.216.1, =0.1.0, =0.18.0, =0.1.0, =0.1.0, =0.2.14, =0.1.0, =0.1.0, =0.0.2, =0.0.2, =1.1.3 Source cves: CVE-2026-86994 Source advisory: MEND:CVE-2026-86994...
Malicious code in @aspect-adv-ui/consent-manager (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b30b507d6c71f746b0af2d19cbbb85357f15189e7e93118c75b4cb215adc0ece @aspect-adv-ui/consent-manager 2.4.1 declares a postinstall hook node setup.js that fires automatically on every npm install. setup.js issues an HTTP...
MAL-2026-16050 Malicious code in @aspect-adv-ui/consent-manager (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b30b507d6c71f746b0af2d19cbbb85357f15189e7e93118c75b4cb215adc0ece @aspect-adv-ui/consent-manager 2.4.1 declares a postinstall hook node setup.js that fires automatically on every npm install. setup.js issues an HTTP...
MAL-2026-16051 Malicious code in @umschool/analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da14c2843514d3c9103335648bc81a8bce18fc173b27c2ab39ebe2c6c0abe028 @umschool/[email protected] targets the internal @umschool npm scope with an implausibly high version number to force resolution over any private...
Malicious code in @umschool/analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da14c2843514d3c9103335648bc81a8bce18fc173b27c2ab39ebe2c6c0abe028 @umschool/[email protected] targets the internal @umschool npm scope with an implausibly high version number to force resolution over any private...
NPM: xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
NPM: xmldom: Processing Instruction Target Injection Bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...
08cms (1.0.0), 0uth (>=1.0.5, <=1.2.1) +12665 more potentially affected by CVE-2026-83608 +1 more via xmldom (>=0.1.2, <=0.6.0)
xmldom NPM version =0.1.2, =1.0.5, =1.0.0, =1.0.0, =1.7.3, =0.1.0, =0.0.2, =0.0.1, =1.0.2, =1.0.3, =1.0.23, =1.0.1, =1.3.1 and more Source cves: CVE-2026-83608, CVE-2026-83613 Source advisory: OSV:GHSA-27P8-2357-5QQV...
NPM: xmldom: DocType `name` Injection Bypasses requireWellFormed
NPM: xmldom: DocType name Injection Bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...
6thbridge-hexa-docs (0.0.1), @12-labours/mapintegratedvuer (>=1.0.0-beta.0, <=1.0.0-beta.14) +1068 more potentially affected by CVE-2026-83618 via @xmldom/xmldom (>=0.9.10, <=0.9.11)
@xmldom/xmldom NPM version =0.9.10, =1.0.0-beta.0, =0.0.1, =0.0.1, =0.0.1, =2.4.4, =0.1.30-develop-map-0, =0.1.0, =0.3.2-beta.0, =0.8.1, =0.1.0, =0.8.0, =0.8.10 - @akhuoa/flatmap-viewer 4.4.4-beta.1 and more Source cves: CVE-2026-83618 Source advisory: GHSA-VR34-HP96-76PP...
NPM: xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
NPM: xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...
NPM: xmldom: Quadratic-time attribute deduplication
NPM: xmldom: Quadratic-time attribute deduplication vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...
NPM: xmldom: Quadratic-memory consumption
NPM: xmldom: Quadratic-memory consumption vulnerability discovered by ? in WordPress Npm xmldom versions = 0.1.5, = 0.6.0...
NPM: joi: Prototype pollution via a `__proto__` language key in custom messages
NPM: joi: Prototype pollution via a proto language key in custom messages vulnerability discovered by ? in WordPress Npm joi versions = 17.2.0, 17.13.6...
