EUVD-2026-45161

A security vulnerability has been detected in sagold json-schema-library 11.5.0/11.5.1. This impacts the function parsePropertyDependencies of the file src/keywords/propertyDependencies.ts. The manipulation leads to improperly controlled modification of object prototype attributes. The attack can...

PT-2026-60739

A security vulnerability has been detected in sagold json-schema-library 11.5.0/11.5.1. This impacts the function parsePropertyDependencies of the file src/keywords/propertyDependencies.ts. The manipulation leads to improperly controlled modification of object prototype attributes. The attack can...

MAL-2026-10726 Malicious code in astro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 949822741657acf4a6b9f6255a2f7a080ca1cc3343e9663020c5e21ce2a6b03c This tarball is published as [email protected] but does not match the legitimate withastro/astro project which is on the v5.x line and depends on picocolor...

MAL-2026-10677 Malicious code in deployowl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b875dd11198fbfc694fe8b3227090e95f13734b5cf64556c6c727b48d7471035 The SDK's captureSnapshot iterates Object.entriesprocess.env and attaches every environment variable to every captured error, then POSTs the payload ...

Malicious code in fastify-bundler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3d824f75a77642b33c2c29524f9decca40c16a12aabe0a2528f3d90deac8720 The package's exported getPlugin function fetches JSON from https://svganchordev.net/icons/105 and passes the response's data.credits field to new...

Security update for gosec (important)

openSUSE Security Update: Security update for gosec Announcement ID: openSUSE-SU-2026:0244-1 Rating: important References: 1265919 1266209 1266793 1267195 Affected Products: openSUSE Backports SLE-15-SP7 An update that contains security fixes can now be installed. Description: This update for gos...

MAL-2026-10507 Malicious code in nodemon-delog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea1c5b4054d6daffaf190005db661027e29255ae20de1bb410f506de1f178532 nodemon-delog is published under a name that resembles the widely-used nodemon package and ships a verbatim copy of nodemon's source tree, README,...

Malicious code in gamified-trading-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f24facab67c0c7bd4775a6081ee54f4fab3fa7a5dd93b52a87f1111088e5e501 The package advertises itself as a trading-gamification library XP, leaderboards, updateProgress/getLeaderboard but its source contains none of those...

MAL-2026-10427 Malicious code in svg-fetcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 542aa371fe6b513dabed7c4f9b5646a104520afa686c6b33abedc21d120ea25f index.js exports getPlugin, which fetches JSON from the hardcoded endpoint https://svganchordev.net/icons/106 and passes the response field...

CVE-2026-15526

A flaw has been found in augmnt augments-mcp-server 7.1.0. This issue affects the function scanProjectDeps of the file src/tools/v4/scan-project-deps.ts of the component scanprojectdeps. Executing a manipulation of the argument packageJsonPath can lead to path traversal. The attack can only be...

CVE-2026-15526

A vulnerability in augmnt augments-mcp-server 7.1.0 affects the function scanProjectDeps (src/tools/v4/scan-project-deps.ts) of the scan_project_deps component. The issue arises from manipulating the argument packageJsonPath, enabling path traversal. The attack is local, and a proof-of-concept/ex...

PT-2026-59057

Summary Two primitive integrators in apm-cli enumerate package files with bare Path.glob / Path.rglob calls and read each match with Path.read text, transparently following symbolic links. A symlink committed inside a remote APM dependency under .apm/prompts/.prompt.md or .apm/agents/.agent.md is...

BIT-AIRFLOW-2026-48891 Apache Airflow: /ui/dependencies scheduling graph leaks unreadable Dag identifiers via trigger/sensor dep.source/dep.target

A bug in Apache Airflow's /ui/dependencies scheduling graph endpoint applied the caller's readable-Dag filter to the top-level serialized Dag key but still emitted referenced Dag IDs through the dep.source and dep.target fields of trigger / sensor dependency entries. An authenticated UI user with...

[SECURITY] Fedora 44 Update: composer-2.10.2-1.fc44

Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/...

[SECURITY] Fedora 43 Update: perl-HTML-Gumbo-0.19-1.fc43

Gumbo is an implementation of the HTML5 parsing algorithm implemented as a pure C99 library with no outside dependencies...

[SECURITY] Fedora 43 Update: composer-2.10.2-1.fc43

Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/...

MAL-2026-10151 Malicious code in buffer-util-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d329e426a3af00dc4cb53c8535a3e53848f09a1b80e561f84f29c77bffe746d7 Package impersonates Feross Aboukhadijeh's widely-used buffer package, copying its author, repository, contributors, and description metadata while...

Injective Labs GitHub Compromise Pushes Wallet-Key-Stealing npm Packages

Unknown threat actors compromised the Injective Labs SDK project's GitHub repository and leveraged it to publish a malicious package on the npm registry to steal cryptocurrency wallet private keys and mnemonic seed phrases. The compromised version, @injectivelabs/[email protected] , came embedded wi...

MAL-2026-10136 Malicious code in transform-es2015-sticky-regex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eadf76ef8e123f9ce50c2910c71912996a3d079a91076ffed8d29830a1687ae1 package.json declares both a dependency and a devDependency on 'transform-es2015-sticky-regex' pointing at...

CVE-2026-61441

PraisonAI Platform praisonai-platform before 0.1.9 improperly authorizes deletion of issue dependencies. The DELETE dependency route accepts either endpoint of a dependency edge and checks delete permission only against the caller-selected URL issue. A workspace member who cannot delete a...