GHSA-RFR2-MQ9M-X2QX vulnerabilities

Vulnerabilities for packages: label-studio...

CVE-2026-54621 vulnerabilities

Vulnerabilities for packages: label-studio...

CVE-2026-54653 vulnerabilities

Vulnerabilities for packages: label-studio...

CVE-2026-54654 vulnerabilities

Vulnerabilities for packages: label-studio...

CVE-2026-54691 vulnerabilities

Vulnerabilities for packages: label-studio...

CVE-2026-55389 vulnerabilities

Vulnerabilities for packages: label-studio...

CVE-2026-55415 vulnerabilities

Vulnerabilities for packages: label-studio...

GHSA-J884-Q54Q-MMX3 vulnerabilities

Vulnerabilities for packages: label-studio...

GHSA-VX7X-VCC2-C44G vulnerabilities

Vulnerabilities for packages: label-studio...

GHSA-5578-W22F-PFX9 vulnerabilities

Vulnerabilities for packages: label-studio...

GHSA-WJV6-JCFJ-MF9R vulnerabilities

Vulnerabilities for packages: label-studio...

CVE-2026-54690 vulnerabilities

Vulnerabilities for packages: label-studio...

GHSA-386Q-5HP3-95M9 vulnerabilities

Vulnerabilities for packages: label-studio...

GHSA-954P-556P-R752 vulnerabilities

Vulnerabilities for packages: label-studio...

GHSA-8359-H9FX-J6V9 vulnerabilities

Vulnerabilities for packages: label-studio...

Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks

A credential-stealing npm worm that first appeared in [email protected] spread beyond the Keyv and Cacheable namespaces into hundreds of packages across multiple organizations on August 4, 2026. SafeDep verified 353 poisoned versions across 79 package names in the npm registry. Its monitoring put the...

MAL-2026-11559 Malicious code in @cacheable/net (npm)

npm/@cacheable/net version 2.1.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

CVE-2026-69110: Improper Limitation of a Pathname to a Restricted Directory

OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:fileName endpoints. Attackers can...

PT-2026-67746

Name of the Vulnerable Software and Affected Versions OpenCode Studio versions prior to 2.4.4 Description Missing authentication allows remote attackers to read arbitrary files within the temp and static/music directories. This is achieved by accessing the 'GET /api/tmp/:tmpFile' and 'GET...

The vulnerability of the “file opening helper” function in the Markdown Preview extension of the Visual Studio Code editor allows a attacker to execute arbitrary code.

The vulnerability of the file opening helper function in the Markdown Preview extension of the Visual Studio Code editor is related to the failure to implement measures to neutralize special elements. Exploiting this vulnerability may allow an attacker operating remotely to execute arbitrary code...