GHSA-6V5V-WF23-FMFQ vulnerabilities

Vulnerabilities for packages: kibana, vitess, semaphore, renovate...

GHSA-7C78-JF6Q-G5CM vulnerabilities

Vulnerabilities for packages: prism, authentik, vitess, wazuh-dashboard-fips, lerna, opensearch-dashboards, pulumi, wazuh-dashboard, arangodb, opensearch-dashboards-fips, authentik-fips, saf...

GHSA-WQFC-CR59-H64P vulnerabilities

Vulnerabilities for packages: yarn...

CVE-2026-48988 vulnerabilities

Vulnerabilities for packages: renovate, vitess...

GHSA-HJXC-462X-X77J vulnerabilities

Vulnerabilities for packages: yarn...

CVE-2026-33815 vulnerabilities

Vulnerabilities for packages: teleport, gitaly...

CVE-2026-22016 vulnerabilities

Vulnerabilities for packages: openjdk...

CVE-2025-53066 vulnerabilities

Vulnerabilities for packages: openjdk...

GHSA-878V-MXG6-VJ8F vulnerabilities

Vulnerabilities for packages: openjdk...

CVE-2026-49459 vulnerabilities

Vulnerabilities for packages: wazuh-dashboard-fips, kibana, langfuse, wazuh-dashboard, librechat, langfuse-fips, nextcloud-server...

GHSA-3PVJ-JV98-QHJQ Chrome DevTools for agents: daemon.pid write follows symlinks in /tmp fallback runtime directory

Summary The chrome-devtools-mcp daemon writes its PID file with fs.writeFileSync to a deterministic runtime path. On typical macOS environments, and on Linux sessions where $XDGRUNTIMEDIR is unset, that runtime path falls back to /tmp/chrome-devtools-mcp-/daemon.pid. Because the write does not us...

MAL-2026-6064 Malicious code in tailwindcss-animates-css (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7250854be2f2ab8b43e62611a704a3c31d3f42180356e61955b4fc30fd2bcf4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-5667 Information Disclosure, Information Tampering, or Denial-of-Service (DoS) Vulnerability in Multiple Home Appliances

Use of Hard-coded Credentials vulnerability in Mitsubishi Electric Room Air Conditioners for Japan and outside Japan; Wireless LAN Adapters for Room Air Conditioners for Japan and outside Japan; Wireless LAN Adapters for Packaged Air Conditioners for Japan and outside Japan; Refrigerators for...

GHSA-WQVQ-JVPQ-H66F vulnerabilities

Vulnerabilities for packages: langfuse-fips, unleash, kibana, langfuse...

CVE-2026-54276 vulnerabilities

Vulnerabilities for packages: open-webui, airflow, mlflow...

firefox: Privilege escalation in the Security component

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the Security component...

Malicious code in @mastra/agent-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49ba6a41e7e43733a8334968ce740af8771208c66c7529d9f4319bd62e39601d @mastra/[email protected] declares a dependency on 'easy-day-js@^1.11.21' in package.json, but the package's own compiled code in dist/index.js nev...

MAL-2026-5996 Malicious code in @mastra/agent-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49ba6a41e7e43733a8334968ce740af8771208c66c7529d9f4319bd62e39601d @mastra/[email protected] declares a dependency on 'easy-day-js@^1.11.21' in package.json, but the package's own compiled code in dist/index.js nev...

Malicious code in @mastra/cursor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a20d5cfabc08a156c36f4febc9204bc1303600106f54ae320b9bfcac7967ca7f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6008 Malicious code in @mastra/cloudflare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ccfd7b5e8a2175fbbd3659131d6268b8a6dcaa22ff084dce526b93a415b018c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...