178218 matches found
MAL-2026-14019 Malicious code in fr-ito-web-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f8b1f66710b1d0686f5d0a6df5989a01bb20a875e380eed8e4be7b94870372e Package's package.json declares both preinstall and postinstall lifecycle hooks that execute node exfil.js on npm install. exfil.js runs whoami and i...
CVE-2026-41706 vulnerabilities
Vulnerabilities for packages: geoserver, apache-nifi-registry...
GHSA-X2R2-RVHQ-2MQV vulnerabilities
Vulnerabilities for packages: geoserver, apache-nifi-registry...
Malicious code in in-install (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58b0bedeac5b8460ad12e0ef3e013f8146eb2b7adacd483c3b8833f1dcbb457b [email protected] declares its ltidisafe dependency as an HTTPS tarball URL hosted on a Google Cloud Storage bucket...
MAL-2026-13982 Malicious code in in-install (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58b0bedeac5b8460ad12e0ef3e013f8146eb2b7adacd483c3b8833f1dcbb457b [email protected] declares its ltidisafe dependency as an HTTPS tarball URL hosted on a Google Cloud Storage bucket...
MAL-2026-13977 Malicious code in cspell-esm (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e857800f57969e257ed22cd056f2e4a4395de09ac9b69becd0c7c2b931314ab Package name resembles the widely-used 'cspell' library but its main entry index.js exports an empty object and provides no functionality. Its...
Malicious code in eslint-generate-prerelease (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26b3f1a7acd55a1642c9615fe72871781a6c0d6bea6f9d31aa42c700aa799704 Package ships an empty module index.js = 'module.exports = ;' under a name that resembles internal tooling, published at an inflated version 99.9.1 —...
MAL-2026-13980 Malicious code in eslint-generate-release (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4478598213eba844460a99bf323ef024e2fb906c918736cc7e593745029e16b4 [email protected] is a hollow package whose index.js exports an empty object and whose only effect on install is dependency resolution...
Malicious code in resolve-audit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86b902b4dc4c2187bb95548ed903dfea70ea626ba5450f031c2cb27b3639dd1c [email protected] is a stub package index exports an empty object whose package.json declares its only dependency ltidisafe as a direct HTTPS...
CVE-2026-54399 vulnerabilities
Vulnerabilities for packages: nrjmx, opensearch, druid, cassandra-reaper, thingsboard, apicurio-registry, akhq...
GHSA-HF6X-8P5F-CGMF vulnerabilities
Vulnerabilities for packages: nrjmx, opensearch, druid, cassandra-reaper, thingsboard, apicurio-registry, akhq...
CVE-2026-73415 vulnerabilities
Vulnerabilities for packages: tensorflow-cpu-jupyter...
CVE-2026-73502 vulnerabilities
Vulnerabilities for packages: crossplane-provider-azure-web, crossplane-provider-aws-codeguruprofiler-fips, crossplane-provider-aws-fis, crossplane-provider-azure-authorization, crossplane-provider-aws-globalaccelerator-fips, crossplane-provider-aws-kendra-fips, crossplane-provider-family-aws,...
CLEANSTART-2026-VU50374 Security fixes in boring-registry-fips 0.15.5-r1
Package boring-registry-fips version 0.15.5-r1 fixes 2 vulnerabilities: CVE-2025-30204, ghsa-mh63-6h87-95cp...
CLEANSTART-2026-OD61763 Security fixes in boring-registry-fips 0.15.5-r2
Package boring-registry-fips version 0.15.5-r2 fixes 2 vulnerabilities: CVE-2025-30204, ghsa-mh63-6h87-95cp...
CVE-2026-8667
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required...
EUVD-2026-57395
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required...
CVE-2026-8667
GitLab CE/EE contains an authorization-level issue: under certain conditions an authenticated user with the developer role could modify package registry metadata without maintainer permissions. Affected versions: 17.6 up to 19.0.5, 19.1 up to 19.1.3, and 19.2 up to 19.2.1. Remediation patches rel...
CVE-2026-8667 Incorrect Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required...