@actual-app/sync-server (>=25.4.0-alpha.0, <=26.6.0-nightly.20260601) potentially affected by CVE-2026-50179 via @actual-app/web (>=25.3.1, <=26.6.0-nightly.20260601)

@actual-app/web NPM version =25.3.1, =25.4.0-alpha.0, =26.6.0-nightly.20260601 Source cves: CVE-2026-50179 Source advisory: MEND:CVE-2026-50179...

@actual-app/sync-server (>=26.1.0-nightly.20251204, <=26.6.0-nightly.20260601) potentially affected by CVE-2026-50179 via @actual-app/web (>=26.1.0-nightly.20251204, <=26.6.0-nightly.20260601)

@actual-app/web NPM version =26.1.0-nightly.20251204, =26.1.0-nightly.20251204, =26.6.0-nightly.20260601 Source cves: CVE-2026-50179 Source advisory: GHSA-XQJM-27PC-RVWM...

@actual-app/sync-server (>=26.1.0-nightly.20251204, <=26.6.0-nightly.20260601) potentially affected by CVE-2026-50179 via @actual-app/web (>=26.1.0-nightly.20251204, <=26.6.0-nightly.20260601)

@actual-app/web NPM version =26.1.0-nightly.20251204, =26.1.0-nightly.20251204, =26.6.0-nightly.20260601 Source cves: CVE-2026-50179 Source advisory: SNYK:JS-ACTUALAPPWEB-17818134...

@actual-app/sync-server (>=26.1.0-nightly.20251204, <=26.6.0-nightly.20260601) potentially affected by CVE-2026-50179 via @actual-app/web (>=26.1.0-nightly.20251204, <=26.6.0-nightly.20260601)

@actual-app/web NPM version =26.1.0-nightly.20251204, =26.1.0-nightly.20251204, =26.6.0-nightly.20260601 Source cves: CVE-2026-50179 Source advisory: OSV:GHSA-XQJM-27PC-RVWM...

com.jalalkiswani:jk-app-web (>=6.2.0, <=6.4.0), com.jalalkiswani:jk-app-webstack (>=6.2.0, <=6.4.0) +9 more potentially affected by CVE-2026-43513 via org.apache.tomcat.embed:tomcat-embed-core (8.5.72)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.72 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.jalalkiswani:jk-app-web =6.2.0, =6.2.0, =6.0.0, =6.0.0, =5.2.5, =5.2.5,...

com.jalalkiswani:jk-app-web (>=6.2.0, <=6.4.0), com.jalalkiswani:jk-app-webstack (>=6.2.0, <=6.4.0) +9 more potentially affected by CVE-2026-41284 via org.apache.tomcat.embed:tomcat-embed-core (8.5.72)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.72 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.jalalkiswani:jk-app-web =6.2.0, =6.2.0, =6.0.0, =6.0.0, =5.2.5, =5.2.5,...

com.jalalkiswani:jk-app-web (>=6.2.0, <=6.4.0), com.jalalkiswani:jk-app-webstack (>=6.2.0, <=6.4.0) +9 more potentially affected by CVE-2026-43515 via org.apache.tomcat.embed:tomcat-embed-core (8.5.72)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.72 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.jalalkiswani:jk-app-web =6.2.0, =6.2.0, =6.0.0, =6.0.0, =5.2.5, =5.2.5,...

com.jalalkiswani:jk-app-web (>=6.2.0, <=6.4.0), com.jalalkiswani:jk-app-webstack (>=6.2.0, <=6.4.0) +9 more potentially affected by CVE-2026-42498 via org.apache.tomcat.embed:tomcat-embed-core (8.5.72)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version 8.5.72 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.tomcat.embed:tomcat-embed-core and may be impacted: - com.jalalkiswani:jk-app-web =6.2.0, =6.2.0, =6.0.0, =6.0.0, =5.2.5, =5.2.5,...

Malicious Package

Overview @alfa.life.mapp/app.web is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious code in @alfa.life.mapp/app.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31f4eb43fd465a585f96a6ae24d86885dcb21e0645e446d9831edce30250a9e The package @alfa.life.mapp/app.web was found to contain malicious code. Source: ghsa-malware...

MAL-2026-3065 Malicious code in @m0ntana/app.web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ffd5d049b453ec288428ae1c5b369effbc0397e753720aeb3900a746bb83519 The package @m0ntana/app.web was found to contain malicious code. Source: ghsa-malware b7fdecb35a1116b81d1340d7d6cc748a050b4dde46beb279a40f6e049955ca...

com.jalalkiswani:j-app-service (>=7.0.0-pre-release, <=7.0.2), com.jalalkiswani:j-app-web (>=7.0.0-pre-release, <=7.0.2) +41 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (22.0.3)

org.keycloak:keycloak-adapter-core MAVEN version 22.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - com.jalalkiswani:j-app-service =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-pre-release,...

EUVD-2025-15519

Malicious code in bioql PyPI...

PT-2024-22461

Name of the Vulnerable Software and Affected Versions sourcecodester Petrol pump management software version 1.0 Description The issue allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted payload to the "admin/app/web crud.php" API...

com.jalalkiswani:j-app-service (>=7.0.0-pre-release, <=7.0.2), com.jalalkiswani:j-app-web (>=7.0.0-pre-release, <=7.0.2) +107 more potentially affected by CVE-2023-6927 via org.keycloak:keycloak-core (22.0.3)

org.keycloak:keycloak-core MAVEN version 22.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.jalalkiswani:j-app-service =7.0.0-pre-release, =7.0.0-pre-release, =7.0.0-pre-release,...

PT-2022-17282

Name of the Vulnerable Software and Affected Versions NTT Resonant Incorporated goo blog App Web Application version 1.0 Description The issue allows attackers to execute arbitrary code via a crafted HTTP request, specifically through CLRF injection. This enables attackers to potentially gain...

CVE-2022-25420: Improper Neutralization of Special Elements in Output Used by a Downstream Component

NTT Resonant Incorporated goo blog App Web Application 1.0 is vulnerable to CLRF injection. This vulnerability allows attackers to execute arbitrary code via a crafted HTTP request...

CVE-2018-7956: Undefined Security Weakness

Huawei VIP App is a mobile app for Malaysia customers that purchased P20 Series, Nova 3/3i and Mate 20. There is a vulnerability in versions before 4.0.5 that attackers can conduct bruteforce to the VIP App Web Services to get user information...