CLSA-2026-1792162120 TuxCare security update for @babel/plugin-transform-object-assign (1 CVE)

TuxCare rebuilt @babel/plugin-transform-object-assign to address 1 CVE. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792162118 TuxCare security update for @babel/plugin-transform-object-assign (1 CVE)

TuxCare rebuilt @babel/plugin-transform-object-assign to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792162117 TuxCare security update for @babel/plugin-transform-object-assign (1 CVE)

TuxCare rebuilt @babel/plugin-transform-object-assign to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

CLSA-2026-1792160970 TuxCare security update for @babel/plugin-transform-object-assign (1 CVE)

TuxCare rebuilt @babel/plugin-transform-object-assign to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

Malicious Package

Overview test-agency-assign is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in test-agency-assign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e650e815b4409c3c07cdab7c953ed69b8052f32a28c3686397ab362bb1bd4552 [email protected] declares a package.json postinstall script wscript.exe Kelimasow.exe that auto-executes a bundled 8.4 MB Go-compiled Windows...

MAL-2026-17295 Malicious code in test-agency-assign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e650e815b4409c3c07cdab7c953ed69b8052f32a28c3686397ab362bb1bd4552 [email protected] declares a package.json postinstall script wscript.exe Kelimasow.exe that auto-executes a bundled 8.4 MB Go-compiled Windows...

GHSA-2MHW-WCX5-V3XJ scim-patch: Mutation of Inherited Built-in Method Objects

Summary Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects scim-patch blocks direct dangerous path segments such as proto, constructor, and prototype, but still traverses inherited properties when applying SCIM patch paths. An attacker who controls a SCIM PATC...

scim-patch: Mutation of Inherited Built-in Method Objects

Summary Incomplete Prototype Pollution Fix Allows Mutation of Inherited Built-in Method Objects scim-patch blocks direct dangerous path segments such as proto, constructor, and prototype, but still traverses inherited properties when applying SCIM patch paths. An attacker who controls a SCIM PATC...

CVE-2026-96772

A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the...

CVE-2026-96772

A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the...

CVE-2026-96772

A security flaw in Intelliants Subrion CMS (up to version 4.2.1 ) allows for information disclosure via a remote attack. The vulnerability exists in an unspecified part of the /actions.json?action=assign-owner endpoint, where manipulating the q argument triggers the disclosure. While an exploit h...

CVE-2026-96772 Intelliants Subrion CMS actions.json assign-owner information disclosure

A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the...

CVE-2026-96772 Intelliants Subrion CMS actions.json assign-owner information disclosure

A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the...

CVE-2026-96772: Exposure of Sensitive Information to an Unauthorized Actor

A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=assign-owner. The manipulation of the argument q results in information disclosure. The attack can be executed remotely. The exploit has been released to the...

CVE-2026-61834

scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate reads inherited properties and assign uses prototype-chain membership checks while resolving attacker-controlled SCIM PATCH paths. A path or one of the dotted value keys beginning with an inherited property such ...

CVE-2026-61834

The scim-patch library, used for applying SCIM patch operations, is vulnerable to process-global mutation in versions prior to 0.9.2 . The root cause lies in the navigate() function reading inherited properties and the assign() function using prototype-chain membership checks when resolving attac...

PT-2026-97326

Name of the Vulnerable Software and Affected Versions scim-patch versions prior to 0.9.2 Description The library fails to properly validate SCIM PATCH paths, allowing the navigate function to read inherited properties and the assign function to use prototype-chain membership checks. An attacker c...

PT-2026-99752

A context safety grant was inherited by a template binding that never earned it, so rebinding a name the view had marked safe left the mark attached to the new, attacker-controlled value. djust's context safety channel is keyed by name, not by value. Every bind copied the value and left the grant...

CVE-2026-18422: Missing Authorization

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action Backend\Page\Multilingual::assign. As a result, an authenticated user who held the Edit Page Multilingual Settings permission on a...