@ancademy/bespoke-classic-client (>=2.2.6, <=2.7.8-alpha.1), @ancademy/bespoke-classic-robot (>=2.2.6, <=2.7.8-alpha.2) +111 more potentially affected by CVE-2026-23966 via sm-crypto (>=0.0.9, <=0.3.13)

sm-crypto NPM version =0.0.9, =2.2.6, =2.2.6, =2.2.6, =2.3.10, =2.1.4, =2.2.6, =2.2.6, =2.2.6, =2.1.15, =2.7.0, =2.1.15, =2.1.4, =2.7.7, =2.7.0, =2.7.8-alpha.1 and more Source cves: CVE-2026-23966 Source advisory: SNYK:JS-SMCRYPTO-15054679...

Malicious Package

Overview storage-types is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview aws-crt-nodejs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @mikudev/ridwan-signal is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview atmbmw is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

@kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.5.9), @netlify/agent-runner-cli (>=1.31.0-alpha, <=1.58.1-alpha) +14 more potentially affected by CVE-2026-21852 via @anthropic-ai/claude-code (>=2.0.0, <=2.0.64)

@anthropic-ai/claude-code NPM version =2.0.0, =0.4.2-beta.2, =1.31.0-alpha, =0.0.1-rc.1, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =0.11.1, =0.11.0, =1.0.0, =0.10.2, =0.11.5 and more Source cves: CVE-2026-21852 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-15046268...

Linux Distros Unpatched Vulnerability : CVE-2025-33230

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NVIDIA Nsight Systems for Linux contains a vulnerability in the .run installer, where an attacker could cause an OS command injection by supplying a malicious...

Linux Distros Unpatched Vulnerability : CVE-2026-21265

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affecte...

EUVD-2026-3402

esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages...

GHSA-2657-3C98-63JQ esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages

Summary The commit does not actually fix the path traversal bug. path.Clean basically normalizes a path but does not prevent absolute paths in a malicious tar file. PoC This test file can demonstrate the basic idea pretty easily: go package server import "archive/tar" "bytes" "compress/gzip"...

Malicious Package

Overview chai-bin is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MiracleLinux 8 : nodejs:12 (AXSA:2020-282:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-282:01 advisory. ICU: Integer overflow in UnicodeString::doAppend CVE-2020-10531 Modularity name: nodejs Stream name: 12 Tenable has extracted the preceding description block...

MiracleLinux 8 : 389-ds:1.4 (AXSA:2021-2352:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-2352:01 advisory. 389-ds-base: CRYPT password hash with asterisk allows any bind attempt to succeed CVE-2021-3652 Tenable has extracted the preceding description block directl...

MiracleLinux 8 : maven:3.5 (AXSA:2022-3741:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3741:01 advisory. maven-shared-utils: Command injection via Commandline class CVE-2022-29599 Tenable has extracted the preceding description block directly from the MiracleLin...

MiracleLinux 8 : pki-core:10.6 (AXSA:2024-8557:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8557:01 advisory. dogtag ca: token authentication bypass vulnerability CVE-2023-4727 Tenable has extracted the preceding description block directly from the MiracleLinux...

MiracleLinux 8 : kernel-4.18.0-553.5.1.el8_10 (AXSA:2024-8481:17)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8481:17 advisory. kernel: Marvin vulnerability side-channel leakage in the RSA decryption operation CVE-2023-6240 kernel: Information disclosure in...

MiracleLinux 8 : bind-9.11.20-5.el8.1 (AXSA:2021-1540:03)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-1540:03 advisory. bind: Buffer overflow in the SPNEGO implementation affecting GSSAPI security policy negotiation CVE-2020-8625 Tenable has extracted the preceding description...

MiracleLinux 8 : emacs-26.1-10.el8.2 (AXSA:2023-6141:08)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6141:08 advisory. emacs: Regression of CVE-2023-28617 fixes in the Asianux Server CVE-2023-2491 Tenable has extracted the preceding description block directly from the...

MiracleLinux 9 : libwebp-1.2.0-7.el9 (AXSA:2023-6426:04)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-6426:04 advisory. libwebp: Heap buffer overflow in WebP Codec CVE-2023-4863 Tenable has extracted the preceding description block directly from the MiracleLinux security...

MiracleLinux 8 : pcre2-10.32-2.el8 (AXSA:2021-1117:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-1117:01 advisory. pcre: Out of bounds read in JIT mode when \X is used in non-UTF mode CVE-2019-20454 Tenable has extracted the preceding description block directly from the...