MAL-2026-1929 Malicious code in @aifabrix/miso-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ddcc2128fa9a68b4ccf29899647a346301d90cb84cb45c30863872c44e2b3ae The package @aifabrix/miso-client was found to contain malicious code. Source: ghsa-malware...

Malicious code in changelog-logger-wrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caec1e4b5fc6ded7cff261c7800c1e9753b865564ac6af1674b9450e4c15f577 The package changelog-logger-wrap was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1928 Malicious code in changelog-logger-wrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector caec1e4b5fc6ded7cff261c7800c1e9753b865564ac6af1674b9450e4c15f577 The package changelog-logger-wrap was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1926 Malicious code in tokenshower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e31db2e66d226160d10fe5f31a29d7b95cba1d0751cc575c0cf6130679170c7a The package tokenshower was found to contain malicious code. Source: ghsa-malware f9fdcfed91dfe75ee3b371ba973a183f42ff3085a29be233f33b5e34249d18cf An...

CVE-2026-4427

Removed by vendor...

Malicious code in chai-as-constrained (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea5f87c9fffb9b32d6390a3922c9a8bfc616a693910c9a8d7599cfa8ef11c9e9 The package chai-as-constrained was found to contain malicious code. Source: ghsa-malware...

CVE-2026-4359

A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver...

UBUNTU-CVE-2026-4359

A compromised third party cloud server or man-in-the-middle attacker could send a malformed HTTP response and cause a crash in applications using the MongoDB C driver...

CVE-2026-32290

The GL-iNet Comet GL-RM1 KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding MD5 hash to pass verification...

CVE-2026-25769 Wazuh Cluster vulnerable to Remote Code Execution via Insecure Deserialization

Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Code Execution RCE vulnerability due to Deserialization of Untrusted Data. All Wazuh deployments using cluster mode master/worker architecture and any...

EUVD-2026-12595

Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Code Execution RCE vulnerability due to Deserialization of Untrusted Data. All Wazuh deployments using cluster mode master/worker architecture and any...

CVE-2026-25769

Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Code Execution RCE vulnerability due to Deserialization of Untrusted Data. All Wazuh deployments using cluster mode master/worker architecture and any...

CVE-2026-32294 JetKVM insufficient firmware verification

JetKVM prior to 0.5.4 does not verify the authenticity of downloaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding SHA256 hash to pass verification...

CVE-2026-32294 JetKVM insufficient firmware verification

JetKVM prior to 0.5.4 does not verify the authenticity of downloaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding SHA256 hash to pass verification...

CVE-2026-32290 GL-iNet Comet (GL-RM1) KVM insufficient firmware verification

The GL-iNet Comet GL-RM1 KVM before version 1.8.2 does not sufficiently verify the authenticity of uploaded firmware files. An attacker-in-the-middle or a compromised update server could modify the firmware and the corresponding MD5 hash to pass verification...

MAL-2026-1493 Malicious code in pino-logger-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5c908d1d5a0d2a6a517ef1aa6e7ab5b7ddc8644dc39730c2629f0226a69121a The package pino-logger-utils was found to contain malicious code. Source: ghsa-malware...

Malicious code in pino-logger-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5c908d1d5a0d2a6a517ef1aa6e7ab5b7ddc8644dc39730c2629f0226a69121a The package pino-logger-utils was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1492 Malicious code in strapi-plugin-workspace-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 360f06861421eccfdc69a5f18ecfe67b3785cb24bb1b0d1e6dd3f5d65df20f20 The package strapi-plugin-workspace-plugin was found to contain malicious code. Source: ghsa-malware...

Malicious code in ember-power-calendar-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55191162c66f85fd90f4c2bb6354b569a7ab7cdc6a380289defcc8be784ed434 The package ember-power-calendar-utils was found to contain malicious code. Source: ghsa-malware...

Malicious code in graphlib-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fc5e5e2ae1439a28be92e99758c3253bf2bd09a568712a5d0725553b4836eaf The package graphlib-js was found to contain malicious code. Source: ghsa-malware 375768659fc55b18acf652226fabd9052c10c4f88d36f150317532bc8661df13 An...