MAL-2026-16087 Malicious code in polygon-toolkits-validator (npm)

[email protected] exports Node crypto helper wrappers, but validateinput base64-encodes its argument and POSTs it to https://raydium-clmm.maingoal.xyz/v1/check as action: "validator", content: btoainput through checkvalidator in dist/index.js, then returns true without validating...

Malicious Package

Overview open-item-validator is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of t...

Malicious code in open-item-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba5b55d57f4938bf2494d369d14434bb80ba6f6c712c7f8d89ae773c27dc457 On require, index.js spawns a detached, unref'd background Node process lib/check-items.js that repeatedly HTTP-GETs a JSON payload from...

MAL-2026-16052 Malicious code in open-item-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba5b55d57f4938bf2494d369d14434bb80ba6f6c712c7f8d89ae773c27dc457 On require, index.js spawns a detached, unref'd background Node process lib/check-items.js that repeatedly HTTP-GETs a JSON payload from...

[SECURITY] [DSA 6490-1] fort-validator security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6490-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff September 08, 2026 https://www.debian.org/security/faq -...

Exploit for CVE-2026-73316

CVE-2026-73316 XenForo before 2.3.13 processes the same valid...

Debian dsa-6490 : fort-validator - security update

The remote Debian 13 host has a package installed that is affected by a vulnerability as referenced in the dsa-6490 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6490-1 [email protected] https://www.debian.org/security/ Moritz...

NewStart CGSL MAIN 7.02 : unbound Multiple Vulnerabilities (NS-SA-2026-0095)

The remote NewStart CGSL host, running version MAIN 7.02, has unbound packages installed that are affected by multiple vulnerabilities: - NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that...

CLSA-2026-1788519023 TuxCare security update for validator (2 CVEs)

TuxCare rebuilt validator to address 2 CVEs. Fixed in 13.12.0-tuxcare.1...

CVE-2026-84469

A flaw was found in fastify. An unauthenticated remote attacker can bypass request validation by exploiting how fastify processes boolean false schemas. When an application intends to deny all input by assigning 'false' to a route's schema, fastify incorrectly treats it as a missing schema and...

CVE-2026-84504

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that...

CVE-2026-84504

A flaw was found in fastify. An authenticated low-privilege caller can exploit a vulnerability where the framework incorrectly processes the result of an Ajv asynchronous async validator. If a request body contains a root-level property named 'value', fastify replaces the entire request body with...

CVE-2026-84504 fastify vulnerable to request body replacement via an async validation result collision

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that...

CVE-2026-84504

fastify versions before 5.12.2 are vulnerable to a request body replacement flaw caused by an Ajv async validator result collision. When a request that passes its route schema contains a root-level property named value, fastify treats that property as the value result protocol used by custom vali...

PT-2026-85451

Name of the Vulnerable Software and Affected Versions fastify versions prior to 5.12.2 Description An issue exists where the object resolved by a successful Ajv async validator is treated as the value result protocol used by custom validator compilers. If a request that passes its route schema...

PT-2026-91375

TuxCare rebuilt validator to address 2 CVEs. Fixed in 13.12.0-tuxcare.1...

PT-2026-85575

llmware 0.4.6 contains an SQL injection vulnerability in the collection-database layer llmware/resources.py where filter and lookup values are directly string-interpolated into SQL WHERE clauses without parameterization or escaping, in both the SQLite and PostgreSQL backends. The filter validator...

gitpython: GitPython: Arbitrary code execution via config-name injection

A flaw was found in GitPython. This vulnerability allows attackers to inject malicious configuration options by manipulating option names within the option-name validator. By injecting special characters, an attacker can forge arbitrary git-config directives, potentially leading to arbitrary code...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

Malicious code in env-validator-tool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd6cff735ec80019a9009add49ea47ae4b34ec0c29c1e287511d765c24300964 The package ships no source module only egg-info metadata despite declaring a consolescript entrypoint 'env-validator=envvalidator.cli:main' that...