GHSA-MPWJ-FCR6-X34C vulnerabilities

Vulnerabilities for packages: yarn...

CVE-2021-4435 vulnerabilities

Vulnerabilities for packages: yarn...

GHSA-6V5V-WF23-FMFQ vulnerabilities

Vulnerabilities for packages: semaphore, vitess, renovate, kibana...

GHSA-7C78-JF6Q-G5CM vulnerabilities

Vulnerabilities for packages: vitess, wazuh-dashboard, pulumi, authentik-fips, opensearch-dashboards-fips, wazuh-dashboard-fips, arangodb, prism, authentik, saf, lerna, opensearch-dashboards...

CVE-2026-48988 vulnerabilities

Vulnerabilities for packages: vitess, renovate...

GHSA-WQFC-CR59-H64P vulnerabilities

Vulnerabilities for packages: yarn...

GHSA-HJXC-462X-X77J vulnerabilities

Vulnerabilities for packages: yarn...

CVE-2026-33815 vulnerabilities

Vulnerabilities for packages: gitaly, teleport...

CVE-2025-53066 vulnerabilities

Vulnerabilities for packages: openjdk...

CVE-2026-22016 vulnerabilities

Vulnerabilities for packages: openjdk...

GHSA-878V-MXG6-VJ8F vulnerabilities

Vulnerabilities for packages: openjdk...

CVE-2026-49459 vulnerabilities

Vulnerabilities for packages: librechat, wazuh-dashboard, wazuh-dashboard-fips, kibana, langfuse-fips, nextcloud-server, langfuse...

GHSA-3PVJ-JV98-QHJQ Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory

Summary The chrome-devtools-mcp daemon writes its PID file with fs.writeFileSync to a deterministic runtime path. On typical macOS environments, and on Linux sessions where $XDGRUNTIMEDIR is unset, that runtime path falls back to /tmp/chrome-devtools-mcp-/daemon.pid. Because the write does not us...

MAL-2026-6064 Malicious code in tailwindcss-animates-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7250854be2f2ab8b43e62611a704a3c31d3f42180356e61955b4fc30fd2bcf4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-5667 Information Disclosure, Information Tampering, or Denial-of-Service (DoS) Vulnerability in Multiple Home Appliances

Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners for Japan and outside Japan; Wireless LAN Adapters for Room Air Conditioners for Japan and outside Japan; Wireless LAN Adapters for Packaged Air Conditioners for Japan and outside Japan; Refrigerators for...

GHSA-WQVQ-JVPQ-H66F vulnerabilities

Vulnerabilities for packages: langfuse-fips, unleash, langfuse, kibana...

CVE-2026-54276 vulnerabilities

Vulnerabilities for packages: airflow, open-webui, mlflow...

firefox: Privilege escalation in the Security component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Security component...

Malicious code in @mastra/agent-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49ba6a41e7e43733a8334968ce740af8771208c66c7529d9f4319bd62e39601d @mastra/[email protected] declares a dependency on 'easy-day-js@^1.11.21' in package.json, but the package's own compiled code in dist/index.js nev...

MAL-2026-5996 Malicious code in @mastra/agent-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49ba6a41e7e43733a8334968ce740af8771208c66c7529d9f4319bd62e39601d @mastra/[email protected] declares a dependency on 'easy-day-js@^1.11.21' in package.json, but the package's own compiled code in dist/index.js nev...