5075 matches found
MAL-2026-12487 Malicious code in travel-core-utils-object (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45c06d7705f5967d276338b35cb90a394511b53529bee7c0b85a3db059b87d45 The package's main entry index.js has a side-effect require of bridge.js, which on load selects a platform-specific asset, fetches an opaque binary...
RHSA-2026:50142 Red Hat Security Advisory: sg3_utils security, bug fix, and enhancement update
Bulletin has no description...
Malicious code in time-utils-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93cbd818e3b29b2b7c9da6f48b3d82baae1af9bd0fa637a2848749bdfea86084 The package advertises itself as a time-formatting utility index.js exports formatDate/capitalize/truncate but ships a postinstall.js lifecycle scrip...
MAL-2026-12182 Malicious code in json-validator-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 255dbc17164a6243a92bab0b4d71132efad3028b53e73d7d2924a1d7ccd1e8cf The package advertises itself as a JSON/XML validator but lib/core.js contains a multi-stage dropper triggered on any call to the public API...
CLSA-2026-1785917160 TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)
TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 3.5.1-tuxcare.1...
CVE-2026-71208: Server-Side Request Forgery (SSRF)
KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...
MiracleLinux 8 : [security - high] javapackages-tools:201801, xmvn-3.0.0-21.module+el8+2012+08762e87, xz-java-1.8-2.module+el8+2012+08762e87 (AXSA:2026-1424:01)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1424:01 advisory. org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2025-67030 Tenable has extracted the preceding description bloc...
MAL-2026-11798 Malicious code in @qlik/nebula-table-utils (npm)
npm/@qlik/nebula-table-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malicious code in @nebula.js/test-utils (npm)
npm/@nebula.js/test-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...
MAL-2026-11585 Malicious code in @nebula.js/test-utils (npm)
npm/@nebula.js/test-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republish...
MAL-2026-11904 Malicious code in @servicetitan/microfront-utils (npm)
npm/@servicetitan/microfront-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malicious code in @servicetitan/microfront-utils (npm)
npm/@servicetitan/microfront-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-11831 Malicious code in @servicetitan/assist-utils (npm)
npm/@servicetitan/assist-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-11926 Malicious code in @servicetitan/startup-utils (npm)
npm/@servicetitan/startup-utils is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
CLSA-2026-1777336747 TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)
TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 1.5.8-tuxcare.1...
CLSA-2026-1775435424 TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)
TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 1.4.5-tuxcare.2...
CLSA-2026-1775089628 TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)
TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 3.1.0-tuxcare.1...
CLSA-2026-1771891821 TuxCare security update for utils-extend (2 CVEs)
TuxCare rebuilt utils-extend to address 2 CVEs. Fixed in 1.0.8-tuxcare.1...