Malicious code in hardhat2-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c07f3569b1ea09e6b004d6249655bfae8ddcec6a95981a49adf26a2a32ebf435 The package hardhat2-config was found to contain malicious code. Source: ghsa-malware dcc4ecf526d7ea6da9ad012c177af156b24bd09ac322140e1390de5a3d20b5b...

Malicious Package

Overview hardhat2-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1414 Malicious code in hardhat2-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c07f3569b1ea09e6b004d6249655bfae8ddcec6a95981a49adf26a2a32ebf435 The package hardhat2-config was found to contain malicious code. Source: ghsa-malware dcc4ecf526d7ea6da9ad012c177af156b24bd09ac322140e1390de5a3d20b5b...

PT-2026-27153

Summary In affected versions of openclaw, channel-initiated config mutations were authorized against the originating account's configWrites policy but did not consistently re-check the targeted account scope. An authorized sender on one account could mutate protected sibling-account configuration...

EUVD-2026-11659

GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the setconfig function. This vulnerability allows attackers to execute arbitrary commands via a crafted input...

CVE-2026-32142

Shopware is an open commerce platform. /api/info/config route exposes information about licenses. This vulnerability is fixed in 7.8.1 and 6.10.15...

EUVD-2026-11663

Shopware is an open commerce platform. /api/info/config route exposes information about licenses. This vulnerability is fixed in 7.8.1 and 6.10.15...

CVE-2026-32142 shopware/commercial: `/api/_info/config` route exposes information about licenses

Shopware is an open commerce platform. /api/info/config route exposes information about licenses. This vulnerability is fixed in 7.8.1 and 6.10.15...

CVE-2026-32142 shopware/commercial: `/api/_info/config` route exposes information about licenses

Shopware is an open commerce platform. /api/info/config route exposes information about licenses. This vulnerability is fixed in 7.8.1 and 6.10.15...

CVE-2026-32142

CVE-2026-32142 affects Shopware Open Commerce Platform. The vulnerable component is the endpoint at /api/_info/config, which exposes information about licenses, creating an information-disclosure risk. The issue is fixed in versions 7.8.1 and 6.10.15 . The CVSS v3.1 score is 5.3 (Medium) with the...

CVE-2026-32100

Shopware is an open commerce platform. /api/info/config route exposes information about active security fixes. This vulnerability is fixed in 2.0.16, 3.0.12, and 4.0.7...

CVE-2026-32100

Shopware is an open commerce platform. /api/info/config route exposes information about active security fixes. This vulnerability is fixed in 2.0.16, 3.0.12, and 4.0.7...

Malicious Package

Overview relay-optimizer-plugin is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior T...

Malicious Package

Overview transform-simplify-comparison-operators is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it...

GHSA-QP4C-XG64-7C6X @backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch

Impact A Server-Side Request Forgery SSRF vulnerability exists in @backstage/plugin-auth-backend when auth.experimentalClientIdMetadataDocuments.enabled is set to true. The CIMD metadata fetch validates the initial clientid hostname against private IP ranges but does not apply the same validation...

BIT-PARSE-2026-31800 Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2 and 8.6.25, the GraphQLConfig and Audience internal classes can be read, modified, and deleted via the generic /classes/GraphQLConfig and /classes/Audience REST API routes withou...

EUVD-2026-11383

ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle...

Tornado is vulnerable to DoS due to too many multipart parts

In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the maxbodysize setting default 100MB. Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart...

GHSA-QJXF-F2MG-C6MC Tornado is vulnerable to DoS due to too many multipart parts

In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the maxbodysize setting default 100MB. Since parsing occurs synchronously on the main thread, this creates the possibility of denial-of-service due to the cost of parsing very large multipart...

Nextcloud: Arbitrary Board Preference Injection via Deck Config API

A vulnerability was discovered in the Deck Config API of the Nextcloud application that allowed authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating the user's ownership or permission to manage the referenced board...