Malicious code in kit-hydration-vim (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9020e6172fe498726bba3d29665f9a0b3f8f6afabf170d7a6dfe44929c506371 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-XPHW-4F88-5F39 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53recoverycontrolconfig-fips, helmfile, apm-server-fips, nifikop-fips, k8sgateway-fips, cloud-provider-azure-fips, crossplane-function-go-templating-fips, kubevela, juicefs, crossplane-provider-aws-organizations-fips, sops-fips,...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: vale, crossplane-function-go-templating-fips, kubevela, helm-diff, dataplaneapi-fips, crossplane-provider-aws-opensearchserverless-fips, cue-fips, tempo-fips, tflint-fips, aws-node-termination-handler-fips, nri-apache, crossplane-provider-aws-elbv2, xeol-fips,...

GHSA-C974-W86C-VPFW vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53recoverycontrolconfig-fips, helmfile, apm-server-fips, nifikop-fips, k8sgateway-fips, cloud-provider-azure-fips, temporal-server, crossplane-function-go-templating-fips, kubevela, deck-fips, juicefs, helm-diff,...

GHSA-25MV-J2QR-V5JQ vulnerabilities

Vulnerabilities for packages: portieris, argo-workflows, nri-haproxy, scorecard, crossplane-provider-aws-sns, slsa-verifier, kaf, kubernetes-csi-node-driver-registrar, rancher-telemetry, dbmate, kapp-controller, ghaudit, argo-cd, tekton-chains, net-kourier, rclone, smokescreen,...

Malicious code in sui-gql-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 26fb6662e9ffe7e92bc1ecedbf01e82c589eaebdbe488ee2b3a17ff3c12081e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bcs-mini (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2cabaabc178202b26609f4cd403279782d153548af197b164715fd8f795f41eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @peptideventure/peptide-unit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 155eb4b5267fa1257d06da30180a29bfd92d5779539c9ffd2160ba836cc7f96f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @peptideventure/peptide-score-modifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fa351dd59830661fec220bea9d36a6b2c84b9107412e6dead9067002ca6f607 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-14071 Malicious code in @peptideventure/peptide-score-modifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fa351dd59830661fec220bea9d36a6b2c84b9107412e6dead9067002ca6f607 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GO-2026-6089 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53recoverycontrolconfig-fips, helmfile, apm-server-fips, nifikop-fips, k8sgateway-fips, cloud-provider-azure-fips, crossplane-function-go-templating-fips, kubevela, juicefs, crossplane-provider-aws-organizations-fips, sops-fips,...

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

Impact Prior to version 0.6.0, mchange-commons-java includes a JNDI ObjectFactory implementation com.mchange.v2.naming.JavaBeanObjectFactory willing to construct objects of arbitrary classes and initialize "JavaBean"-style properties. There are classes for which this kind of initialization is...

CVE-2026-49457 QUIC has Broken TLS verification

erlangquic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificat...

CVE-2026-47192 kas's late signature validation may allow unnoticed repository manipulations

kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the...

CVE-2026-47191

CVE-2026-47191 affects the kas setup tool for BitBake-based projects. Before version 5.3, reliant on a git commit ID (SHA-1/SHA-256) to validate repository state could mislead users into checking out a branch with the same name, potentially indicating a repository takeover. The primary impact con...

Malicious code in @devmikets/hyperliquid-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c401f279d5ea91e416e18e54888c22d1087a44449aa9629dfb86f3c5945ec903 package.json declares inquirer with a tarball URL pointing at registrynpmjs.to — a domain that typosquats the official npm registry registry.npmjs.or...

MAL-2026-14042 Malicious code in @devmikets/hyperliquid-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c401f279d5ea91e416e18e54888c22d1087a44449aa9629dfb86f3c5945ec903 package.json declares inquirer with a tarball URL pointing at registrynpmjs.to — a domain that typosquats the official npm registry registry.npmjs.or...

Malicious code in @demopack/www (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d65caef119676a35e0ed5c3ef5a3be0d08c6a487c57270c802319fe68521dadd Package.json describes the package as 'Static assets distribution', but the shipped HTML/JS is an iOS-version-gated payload loader. js/index.js...

CVE-2026-72826

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission requires only the baseline api.access scope, and the new key's scopes are read directl...

Malicious code in ak-mal-test-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb1e00b87448788cd84d0c30aa68374d531288859498450fe6db4ab3e2d63e42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...