Race Condition

Overview effect is a node package that allows you to add effects on images. Affected versions of this package are vulnerable to Race Condition in the MixedScheduler class, where the AsyncLocalStorage context is not properly isolated between concurrent fiber executions. An attacker can access or...

Denial Of Service (DoS)

Node.js is vulnerable to Denial of Service DoS. The vulnerability is due to improper error handling when asynchooks.createHook is enabled, where "Maximum call stack size exceeded" errors become uncatchable and terminate the process instead of reaching uncaughtException, allowing attackers to...

jackson-core -- StreamReadConstraints can be bypassed

The Jackson project reports: Enforce maxNameLength incrementally in ReaderBasedJsonParser Fail parsing from DataInput if StreamReadConstraints.getMaxDocumentLength set Fix maxDocumentLength bypass in async parser single feedInput case Enforce StreamReadConstraints.maxNumberLength for non-blocking...

UBUNTU-CVE-2026-23265

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on node footer in read,writeendio ----------- cut here ------------ kernel BUG at fs/f2fs/data.c:358! Call Trace: blkupdaterequest+0x5eb/0xe70 block/blk-mq.c:987 blkmqendrequest+0x3e/0x70...

Malicious code in chain-promised-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9260393814045a3ce0ce9a27ff97fffcbaad7b38ad91f54d8cad995c3deb43af The package chain-promised-async was found to contain malicious code...

MAL-2026-1689 Malicious code in chain-promised-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9260393814045a3ce0ce9a27ff97fffcbaad7b38ad91f54d8cad995c3deb43af The package chain-promised-async was found to contain malicious code...

Malicious code in chai-promised-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5884b19c92ddf330516683f9cc004dabf1dd94e8fe15d4c809d59ecb63dc55c0 The package chai-promised-async was found to contain malicious code...

MAL-2026-1679 Malicious code in chai-promised-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5884b19c92ddf330516683f9cc004dabf1dd94e8fe15d4c809d59ecb63dc55c0 The package chai-promised-async was found to contain malicious code...

Malicious code in chai-cli-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d9f4be84db26d0ce71d5bcfda424b1af08abddc37c23d3a2ef2b4263534fde2 The package chai-cli-async was found to contain malicious code...

MAL-2026-1677 Malicious code in chai-cli-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1d9f4be84db26d0ce71d5bcfda424b1af08abddc37c23d3a2ef2b4263534fde2 The package chai-cli-async was found to contain malicious code...

Malicious code in async-substrate-interface-sub (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in syntax-async-generators (npm)

The package 'syntax-async-generators' is part of the PhantomRaven supply chain attack campaign Wave 3. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

MAL-2026-1558 Malicious code in syntax-async-generators (npm)

The package 'syntax-async-generators' is part of the PhantomRaven supply chain attack campaign Wave 3. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

EulerOS 2.0 SP12 : libwebsockets (EulerOS-SA-2026-1373)

According to the versions of the libwebsockets package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Stack-based Buffer Overflow in lwsadnsparselabel in warmcat libwebsockets allows, when the LWSWITHSYSASYNCDNS flag is enabled during...

Malicious Package

Overview syntax-async-generators is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior...

EUVD-2026-11367

StudioCMS S3 Storage Manager Authorization Bypass via Missing await on Async Auth Check...

GHSA-MM78-FGQ8-6PGR StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check

Summary The S3 storage manager's isAuthorized function is declared async returns Promise but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in JavaScript, !isAuthorizedtype always evaluates to false, completely bypassing the authorization check...

CVE-2026-31954

Emlog is an open source website building system. In 2.6.6 and earlier, the deleteasync action asynchronous delete lacks a call to LoginAuth::checkToken, enabling CSRF attacks...

CVE-2026-32101 StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized function is declared async returns Promise but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in...

CVE-2026-32101

CVE-2026-32101 affects StudioCMS S3 Storage Manager prior to version 0.3.1. The isAuthorized() function is async but is called without await in both the POST and PUT handlers, causing the authorization check to always evaluate to bypass due to Promise objects being truthy. As a result, any authen...