MAL-2026-18342 Malicious code in string-target-mapper-hash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f356f513bed48330cd1a0538e53ac429f5570385e8b0bcc3fcc5c94876e437b package.json declares its sole dependency shard-writer-parser-mutex as a bare HTTPS URL to a non-registry host...

Malicious code in string-target-mapper-hash (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f356f513bed48330cd1a0538e53ac429f5570385e8b0bcc3fcc5c94876e437b package.json declares its sole dependency shard-writer-parser-mutex as a bare HTTPS URL to a non-registry host...

Malware in string-target-mapper-hash

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2026-110469

Datadog dd-trace-py: ReDoS in URL query string obfuscation...

Datadog dd-trace-py: ReDoS in URL query string obfuscation

Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...

GHSA-3633-R77Q-H3V3 Datadog dd-trace-py: ReDoS in URL query string obfuscation

Summary A regular expression used to obfuscate URL query strings can consume excessive CPU when processing certain attacker-controlled input. This can stall request processing and cause denial of service in applications using affected HTTP tracing integrations. Details The default query-string...

EUVD-2026-110470

Datadog dd-trace-py: IAST instrumentation can lead to application DOS...

Datadog dd-trace-py: IAST instrumentation can lead to application DOS

Summary A flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. Details The affected IAST string-processing...

GHSA-P3M5-H5V9-VQJ6 Datadog dd-trace-py: IAST instrumentation can lead to application DOS

Summary A flaw in dd-trace-py’s IAST instrumentation can cause the Python application process to terminate unexpectedly when processing certain attacker-controlled input. Only applications with IAST enabled are affected. IAST is disabled by default. Details The affected IAST string-processing...

Uncaught Exception

Overview ddtrace is a Datadog APM client library Affected versions of this package are vulnerable to Uncaught Exception via moduloaspect in the IAST taint-tracking C++ extension, when a lone surrogate character is passed as a format argument to the % modulo string operator. The unhandled surrogat...

Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content

Description def escapev: str - str: return strv.replace"'", "\'".replace"\", "\\" The escaping order is backwards, exactly like the classic HTML double-escape bug: step 1 inserts a literal backslash in front of every ', then step 2 re-matches that just-inserted backslash and doubles it. For an...

GHSA-VQRG-773H-4WXC Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content

Description def escapev: str - str: return strv.replace"'", "\'".replace"\", "\\" The escaping order is backwards, exactly like the classic HTML double-escape bug: step 1 inserts a literal backslash in front of every ', then step 2 re-matches that just-inserted backslash and doubles it. For an...

Dataedo Portal Hangfire scheduler SQL injection RCE

Portal login → repository connection-string → SQL inject Hangfire job Process.Start requires sqlcmd to agent DB. """Dataedo Portal 26.2.8 with Dataedo Agent 26.2.8 - Unrestricted Job-Type Deserialization in the Agent Scheduler Storage, Reached Through the Repository Connection-String API CWE-502"...

Dataedo Portal 26.2.8 with Dataedo Agent 26.2.8 - Unrestricted Job-Type Deserial — Detect

Fingerprint / reachability check for Dataedo Portal 26.2.8 with Dataedo Agent 26.2.8 - Unrestricted Job-Type Deserialization in the Agent Scheduler Storage, Reached Through the Repository Connection-String API CWE-502 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Dataedo Portal 26.2....

Exploit for CVE-2026-114509

CVE-2026-114509 Laravel TokenGuard authentication bypass thro...

CVE-2026-110910

Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & or the configured delimiter, =, or therefore becomes query string syntax instead of data, so a caller-supplied key name can add...

CVE-2026-110910

The qs library (versions >=6.12.0

CVE-2026-110910

Summary "qs.stringify" with "allowEmptyArrays: true" writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains "&" or the configured "delimiter", "=", or "" therefore becomes query string syntax instead of data, so a caller-supplied key nam...

CVE-2026-110910 qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & or the configured delimiter, =, or therefore becomes query string syntax instead of data, so a caller-supplied key name can add...

CVE-2026-110910 qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection

Summary qs.stringify with allowEmptyArrays: true writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains & or the configured delimiter, =, or therefore becomes query string syntax instead of data, so a caller-supplied key name can add...