PT-2026-95432

Name of the Vulnerable Software and Affected Versions SGLang versions prior to 0.5.20 Description When operating in prefill/decode disaggregation mode with the Mooncake KV transfer backend, the system fails to validate bootstrap room values. This allows for unbounded transfer state allocation...

PT-2026-95261

Name of the Vulnerable Software and Affected Versions All Bootstrap Blocks WordPress plugin versions prior to 1.3.32 Description The plugin fails to validate a block attribute used to construct a filesystem path during rendering. This allows users with contributor-level access or higher to perfor...

Malicious code in link-pino-pretty-react-bootstrap-cordelia (npm)

Source: amazon-inspector 386846b5eb8ea17261166715d1b01f258c84fe3bd709898c4c45ac12b4038d21 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in levels-got-react-bootstrap-selenium (npm)

Source: amazon-inspector 5363bd2c5ca34ed6da0f38e5ce8bfd01cc4b3432a01f7c875401e1d2f2289dc7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in less-loader-react-bootstrap-cosmicray-spectroscopy (npm)

Source: amazon-inspector 34b22a3237ae7e67de2b1fded90e8aad83a6fa3a88ed44ce7d4329367a38aa5d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in less-cors-bootstrap-lyra (npm)

Source: amazon-inspector a625b4f86ac38833ce2bcd8b9b3317525645addade1fd9703904c39a78828bd7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CVE-2026-54581

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchbootstrapindex function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or...

CVE-2026-54581

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchbootstrapindex function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or...

EUVD-2026-82318

mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchbootstrapindex function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or...

CVE-2026-92972 SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint

SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rankip and rankport values to redirect decode workers to...

CVE-2026-92972 SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint

SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rankip and rankport values to redirect decode workers to...

EUVD-2026-81581

SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service that allows attackers to poison the KV transfer routing table. Attackers can supply arbitrary rankip and rankport values to redirect decode workers to...

Malicious code in lacerta-deneb-react-bootstrap-gravity (npm)

Source: amazon-inspector 8ee4a9712b532e871f7b4ddaa054d992da7855fe931e1bc6d0a47c71aa8e651e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lacerta-dotenv-parse-variables-charon-bootstrap (npm)

Source: amazon-inspector 655f0990025331f26bea8ba9a4718b3206e5931ea8fefccd766e369c6312c564 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in koa-module-bootstrap-spica (npm)

Source: amazon-inspector 91a4cb222471bc51975749e78a4951f374ebdaaf33f053ab57fbcd73c4c00e15 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kinetic-ora-bootstrap-redshift (npm)

Source: amazon-inspector 9c94144702a359f66450437efd957137a56b3bce619a4b13ed508a050d09d69e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in karma-fornax-react-bootstrap-draco (npm)

Source: amazon-inspector 692a2c9da87e3f2f27a132a25c2aa343f1b3f5c7d705d7a5a74fbdca38cf1da0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jwt-telesto-bootstrap-ophiuchus (npm)

Source: amazon-inspector 3e8e9921872e0584a4359c709971f101c91881e4b879963244f8b683d3c58d81 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in jupiter-react-bootstrap-sedimentology-prettier-stylelint (npm)

The package jupiter-react-bootstrap-sedimentology-prettier-stylelint was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in juno-sirius-react-bootstrap-weywot (npm)

Source: amazon-inspector 1187ba054fc9b46477a91275100c1ebc2b34469d8a5e8314d2cfb9fe05d71488 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...