Important: Red Hat Security Advisory: Red Hat AMQ Broker 7.14.1 release and security update

Red Hat AMQ Broker 7.14.1 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

axios: Axios: Man-in-the-Middle (MITM) attack via Prototype Pollution

A flaw was found in Axios. This vulnerability, a Prototype Pollution "Gadget" attack, allows an attacker to escalate any existing Object.prototype pollution in an application's dependency tree into a full Man-in-the-Middle MITM attack. This enables the attacker to intercept, read, and modify all...

axios: Axios: Prototype pollution allows information disclosure and request manipulation

A flaw was found in Axios, a widely used HTTP client. This vulnerability, known as prototype pollution, allows an attacker to inject malicious properties into core JavaScript objects. When another component in the same application environment is compromised and pollutes the system's object...

Malicious code in fadhil-mendoan28-riris (npm)

Source: amazon-inspector 6a05a3f2dab3d437ac4e32529550f928f07dffdbafb3c2dd2d8a0dbb80f94640 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eva-teadev (npm)

Source: amazon-inspector 9a0b18351b428ec56da48e6203ace8a5d8558d609ed659b9aab6c78658750a14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in erwin-naget81-sukiwir (npm)

Source: amazon-inspector 4bd3b081a2177d07a8c713f3ccac7ea9619d4227d844a2abb1091c7cc2e263ea This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in erick-tomat56-pore (npm)

Source: amazon-inspector da9af9994ec721c8c526b1fd9af9734df2dbfbb3fb1620e3e5c45d439804c004 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in erick-martabak31-riris (npm)

Source: amazon-inspector a2d2be99d79dca7d6df2f7433968e089e27fb2bfa3b9dc83c3f945ef0d59d577 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in equivalent_dove_z3n (npm)

Source: amazon-inspector e1573034cb16288116a4d9db1992c47f005cf642fc36aa22b2e52c04769993ac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in enceladus-stream-chai-loglevel (npm)

Source: amazon-inspector 8a963320fc9701dd9f33123eca2220399517e38a891994d0bbc0ab226aabcf31 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in emotional_elephant_z3n (npm)

Source: amazon-inspector 9cd64957c47ebe50adfa88f2f8b1595c65d805aaf3da009ab8db1d5a2a7ed109 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eko-taiwan59-breki (npm)

Source: amazon-inspector de7581b1fb6269e51c8fe5f19acb4d0d598b9477c6c4db1cec74566306756301 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in eka-gulai21-miaww (npm)

Source: amazon-inspector 4e4c261f6564beff2ae8939a75dfc2aa2b8785399ff1f52944e7defd26aa3ad4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CVE-2026-89011: Improperly Controlled Modification of Object Prototype Attributes

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing 'proto' path segments during ref negotiation. Attackers controlling a Git...

PT-2026-89581

isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server operator to pollute Object.prototype by advertising crafted ref names containing ' proto ' path segments during ref negotiation. Attackers controlling a Git...

Security Bulletin: Vulnerability in js-yaml affects IBM Virtualization Engine TS7700

Summary IBM Virtualization Engine TS7700 is susceptible to a Privilege Escalation / Denial of Service CVE-2026-64718 threat due to the use of js-yaml. js-yaml is part of Node.js, which is used by TS7700 to provide the Management Interface. Vulnerability Details CVEID:CVE-2025-64718 DESCRIPTION:...

ROOT-APP-NPM-GHSA-8X6C-CV3V-VP6G GHSA-8x6c-cv3v-vp6g in cacheable-request - Patched by Root

Root has patched GHSA-8x6c-cv3v-vp6g in the cacheable-request package for Root:npm. Multiple fixed versions available...

Prototype Pollution

node-csv is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of duplicate proto CSV headers when columns and groupcolumnsbyname are enabled, which allows an attacker to inject an attacker-controlled array into the parsed record's prototype and manipulate inherited...

CVE-2026-63376

A flaw was found in toml-node, a software library used for parsing TOML Tom's Obvious, Minimal Language files in Node.js and web applications. A remote attacker could exploit a vulnerability known as prototype pollution by providing specially crafted TOML input. This could allow the attacker to...

CVE-2026-86078

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connection keys from stored workflows as ordinary object keys. A workflow submitted through the REST API could contain proto or constructor, causing nested writes t...