0utmailauth (1.0.0), @1023-ventures/ursa-core (>=0.5.2, <=0.5.3) +2083 more potentially affected by CVE-2026-6733 via undici (>=6.0.0, <=6.26.0)

undici NPM version =6.0.0, =0.5.2, =0.5.2, =0.4.2, =0.5.116, =4.5.8, =4.5.8, =4.5.8, =4.5.8, =4.3.3, =1.0.0, =1.0.0, =0.1.5-alpha.0, =0.1.6 and more Source cves: CVE-2026-6733 Source advisory: OSV:GHSA-35P6-XMWP-9G52...

jfp-console-poc

JFP Console PoC Tamper-evident autonomous system governor w...

Malicious code in conversa-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector baaff1de63d44fd5f6b4fb1c5d3ebb4e9509d7581ff9afa5f339acad8f57aed0 On npm install, postinstall.js unconditionally reads the installer's /.npmrc which typically contains //registry.npmjs.org/:authToken=... along with...

PT-2026-53787

An authenticated user could crash a SurrealDB server with a single query containing a long chain of operators. Such a query — for example RETURN 1 + 1 + 1 + ... with tens of thousands of terms — is parsed into an expression tree one level deep per operator. Because the chain is flat and the pratt...

A Longitudinal Study of Android Apps Signing Key Protection

Android app signing relies on developer-managed credentials, making secure key protection essential for the integrity of the software supply chain. A recent platform key leakage incident involving two major OEM manufacturers demonstrates that even robustly designed signing mechanisms can be...

PT-2026-51115

Name of the Vulnerable Software and Affected Versions go.qbee.io/transport versions prior to v1.26.25 Description The extractTar routine in the go.qbee.io/transport library contains a symlink-chain path traversal issue. Because path validation is strictly lexical and does not account for on-disk...

crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation

A flaw was found in Go's crypto/x509 package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service DoS for...

crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building

A flaw was found in the Go standard library packages crypto/x509 and crypto/tls. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being...

alass-util (0.3.0), cervo (>=0.1.0, <=0.5.1) +25 more potentially affected by CVE-2026-55093 via tract-nnef (>=0.10.10, <=0.20.7)

tract-nnef CARGO version =0.10.10, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.2.0, =1.2.0, =0.4.0, =0.2.0, =0.10.0, =0.19.0-alpha.8, =0.11.0, =0.12.5 and more Source cves: CVE-2026-55093 Source advisory: OSV:GHSA-X5MV-8WGW-29HG...

tamilai (0.0.2) potentially affected by CVE-2026-57137 via praisonai (1.7.1)

praisonai NPM version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on praisonai and may be impacted: - tamilai 0.0.2 Source cves: CVE-2026-57137 Source advisory: SNYK:JS-PRAISONAI-17660577...

npm PraisonAI codeMode sandbox escape via Function constructor

Summary The published npm package praisonai exports a TypeScript built-in tool named codeMode. The package describes this tool as executing code in a sandboxed environment, marks its capability as sandbox: true, and registers it through the public tools facade. The implementation does not create ...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 0726react (0.1.1) +31064 more potentially affected by CVE-2026-55602 via http-proxy-middleware (>=0.16.0, <=2.0.9)

http-proxy-middleware NPM version =0.16.0, =1.0.1, =1.1.0 - 0726react 0.1.1 - 0x0.icu.anima 0.1.0 - 0xgank-tea-advice-pull 1.0.0 - 0xgank-tea-balance-pencil 1.0.0 - 0xgank-tea-brick-bell 1.0.0 - 0xgank-tea-cake-victory 1.0.0 - 0xgank-tea-central-compound 1.0.0 - 0xgank-tea-characteristic 1.0.0 -...

@angular-architects/build-angular (16.2.0-next.2), @angular-builders/custom-esbuild (>=17.1.0-beta.0, <=19.1.0) +167 more potentially affected by CVE-2026-55388 via piscina (>=4.0.0, <=4.9.2)

piscina NPM version =4.0.0, =17.1.0-beta.0, =16.0.0-beta.0, =18.2.6-RC-1, =16.0.0, =16.2.0-next.0, =18.0.0-next.3, =2.2.7-bb.6, =2.1.5, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.17-dev.40 and more Source cves: CVE-2026-55388 Source advisory: OSV:GHSA-X9G3-XRWR-CWFG...

GHSA-X9G3-XRWR-CWFG piscina: Prototype Pollution Gadget → RCE via inherited options.filename

Summary piscina's constructor and run paths read the filename option via plain member access: js // dist/index.js line 92 constructor const filename = options.filename ? 0, common1.maybeFileURLToPathoptions.filename : null; this.options = ...kDefaultOptions, ...options, filename, maxQueue: 0 ; //...

GHSA-VPMM-X3FM-QR5C jodit: Prototype pollution in Jodit via Jodit.modules.Helpers.set()

Summary Jodit.modules.Helpers.setchain, value, obj walks the dot-separated chain, creating and following each path segment, without filtering prototype-mutating keys. A chain that begins with or contains proto, constructor, or prototype lets the final assignment reach and mutate Object.prototype...

alass-util (0.3.0), cervo (>=0.1.0, <=0.5.1) +25 more potentially affected by CVE-2026-55093 via tract-nnef (>=0.10.10, <=0.20.7)

tract-nnef CARGO version =0.10.10, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.2.0, =1.2.0, =0.4.0, =0.2.0, =0.10.0, =0.19.0-alpha.8, =0.11.0, =0.12.5 and more Source cves: CVE-2026-55093 Source advisory: OSV:RUSTSEC-2026-0217...

MAL-2026-6091 Malicious code in datacamp-light (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dbdcc4ef12aca6461f8e765976a7b2b33099a1791a7aee7e353371b7954a91c Package impersonates the DataCamp brand while shipping near-empty stub exports index.js init/helper return trivial constants. The postinstall lifecyc...

PT-2026-50745

Name of the Vulnerable Software and Affected Versions Jodit Editor versions prior to 4.12.26 Description Prototype pollution occurs when an attacker can manipulate the prototype of an object, potentially leading to property injection, logic bypass, denial of service, or other security issues. The...

Malicious code in set-proto-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdb11eef3afbfc268bd48a18737884246861c7ae9e6a3d29901ae1379216c633 lib/index.js contains a base64-encoded URL decoding to https://jsonkeeper.com/b/BN77K, an anonymous mutable paste host that is fetched via axios.get;...

MAL-2026-6079 Malicious code in set-proto-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdb11eef3afbfc268bd48a18737884246861c7ae9e6a3d29901ae1379216c633 lib/index.js contains a base64-encoded URL decoding to https://jsonkeeper.com/b/BN77K, an anonymous mutable paste host that is fetched via axios.get;...