264 matches found
MAL-2026-15970 Malicious code in array-scala (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 78c71ee306356b5d27d673ae95bba2a24093aeac12e43044bd2503aa8c3d9024 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious Package
Overview array-scala is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...
GHSA-93J5-89VC-PPH4 vulnerabilities
Vulnerabilities for packages: zipkin, druid, logstash, cassandra-reaper, thingsboard...
EUVD-2026-57635
blaze is a Scala library for building asynchronous pipelines, with a focus on network IO. Prior to 0.23.18 and 1.0.0-M42, blaze-server can merge HTTP/1.1 chunked-body trailer fields into Request.headers. Because trailer fields are attacker-controlled, an unauthenticated remote client can inject...
GHSA-M2PW-22CJ-JQ4V
creationtimestamp| type| source ---|---|--- 2026-08-10 21:27:13+00:00| seen| https://bsky.app/profile/scala-lang.org/post/3msr24brbfc2h...
PT-2026-60699
Name of the Vulnerable Software and Affected Versions Jawn versions prior to 1.7.0 Description Jawn parse methods allow arbitrarily deep JSON array and object nesting without a depth limit. A remote attacker can submit untrusted JSON to grow parser contexts until the JVM heap is exhausted,...
ROOT-APP-MAVEN-CVE-2022-36944 CVE-2022-36944 in io.root.org.scala-lang:scala-library - Patched by Root
Root has patched CVE-2022-36944 in the io.root.org.scala-lang:scala-library package for Root:Maven. Multiple fixed versions available...
OS Command Injection
sbt is vulnerable to OS Command Injection. The vulnerability is due to the lack of validation of the URI fragment, where a malicious fragment can execute arbitrary commands because cmd /c interprets &, |, and ; as command separators...
CVE-2026-32948 sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
sbt is a build tool for Scala, Java, and others. From version 0.9.5 to before version 1.12.7, on Windows, sbt uses Process"cmd", "/c", ... to run VCS commands git, hg, svn. The URI fragment branch, tag, revision is user-controlled via the build definition and passed to these commands without...
EUVD-2026-14990
sbt: Source dependency feature via crafted VCS URL leads to arbitrary code execution on Windows...
Command Injection
Overview org.scala-sbt:main2.11 is a sbt is an interactive build tool Affected versions of this package are vulnerable to Command Injection in the Process"cmd", "/c", ... used to execute VCS commands on Windows when handling user-controlled URI fragments. An attacker can execute arbitrary Windows...
GHSA-X4FF-Q6H8-V7GW sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
Summary On Windows, sbt uses Process"cmd", "/c", ... to run VCS commands git, hg, svn. The URI fragment branch, tag, revision is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious...
sbt: Source dependency feature (via crafted VCS URL) leads to arbitrary code execution on Windows
Summary On Windows, sbt uses Process"cmd", "/c", ... to run VCS commands git, hg, svn. The URI fragment branch, tag, revision is user-controlled via the build definition and passed to these commands without validation. Because cmd /c interprets &, |, and ; as command separators, a malicious...
EUVD-2018-0669
Malware in sbrugna...
EUVD-2021-1049
Malware in sbrugna...
EUVD-2019-0212
Malware in sbrugna...
EUVD-2014-1175
Malware in sbrugna...
EUVD-2023-0335
Malicious code in bioql PyPI...