Malicious code in @bil-rgb/baileys (npm)

Source: amazon-inspector 3bcbf6493a6aa37ccc827723d6fd73b082c66d10a549af2413aba2a8a6f47b7f package.json for @bil-rgb/[email protected] declares its libsignal dependency as github:tenka-san/libsignal-node with no commit SHA, no tag, and no integrity check. npm install resolves this value by cloning...

CVE-2021-43616

Repo demonstrating CVE-2021-43616 / https://github.com/npm/cli/issues/2701 Remove the nodemodules folder and run npx npm@8 ci, you can see how npm will install version 2.2.x 2.2.16 at the time of this commit even though package-lock.json requires 2.0.0 cat nodemodules/shortid/package.json I've...

MAL-2026-18278 Malicious code in @factoryz/apollo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5adaa62818c76a10cbf0b536a6854633e24a73028c803fc597c5b5ec1d78b8ad The package ships only an empty stub module.exports = and a manifest whose sole dependency ltidisafe is resolved from a hardcoded off-registry HTTPS...

Unsafe Dependency Resolution

Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution via insufficient validation of the required-version field in action/main.py. When the required-version key in pyproject.toml is set to a value that resembles a direct reference e.g., a VCS URL or a local pat...

Unsafe Dependency Resolution

Overview @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Unsafe Dependency Resolution vi...

PT-2026-110633

Name of the Vulnerable Software and Affected Versions hexpm hex versions 2.5.0 through 2.5.1 Description A protection mechanism failure allows a package owner or an attacker with account access to bypass the release-age cooldown. The cooldown, configured via cooldown or HEX COOLDOWN, normally...

SUSE-SU-2026:4589-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2026-59946: package bin entries with path segments can cause unintended host file permission modifications bsc1271152. - CVE-2026-59947: unsanitized URL credential handling in debug output within Composer can allow sensitive token...

SUSE-SU-2026:4283-1 Security update for php-composer2

This update for php-composer2 fixes the following issues: - CVE-2026-45793: GitHub OAuth tokens failing regex validation can cause credential disclosure bsc1271504. - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898. - CVE-2026-59946:...

Unsafe Dependency Resolution

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Unsafe Dependency Resolution through the model artifact loading...

Fedora 44 : apache-ivy (2026-c02768c662)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c02768c662 advisory. IMPROVEMENT: ivy:retrieve and the 'post resolve tasks' now support the override child element. IVY-1664 IMPROVEMENT: ivy:makepom will now add override elemen...

CVE-2026-82327

A flaw was found in libsolv, a dependency-resolution library used by RPM-based package managers such as dnf and zypper to work with .solv repository cache files. When libsolv rewrites a .solv cache file, it reads directory-id values from the file's compressed filelist data without validating that...

Unsafe Dependency Resolution

Overview org.springframework.graphql:spring-graphql is a GraphQL Support for Spring Applications Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the GraphiQL. An attacker can execute arbitrary JavaScript code in the context of users' browsers by compromising t...

Unsafe Dependency Resolution

Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution in the COPY FROM STDIN process. An attacker can execute arbitrary commands by injecting specially crafted data lines when an early failure occurs before the server signals readiness for input rows. This is...

openSUSE 16 Security Update : gleam (openSUSE-SU-2026:21557-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21557-1 advisory. Changes in gleam: - Update to 1.18.1: CVE-2026-59247: insufficient verification of data authenticity allows a MITM adversary to substitute forged Hex...

Security update for gleam (moderate)

openSUSE security update: security update for gleam ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21557-1 Rating: moderate References: bsc1272992 Cross-References: CVE-2026-59247 Affected Products: openSUSE Leap 16.0...

OPENSUSE-SU-2026:21557-1 Security update for gleam

This update for gleam fixes the following issues: Changes in gleam: - Update to 1.18.1: CVE-2026-59247: insufficient verification of data authenticity allows a MITM adversary to substitute forged Hex package contents during dependency resolution bsc1272992 Set minimum required Erlang version to 2...

SUSE CVE-2026-59247

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

CVE-2026-59247 Insufficient verification of Hex package metadata in Gleam

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

CVE-2026-59247 Insufficient verification of Hex package metadata in Gleam

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

CVE-2026-59247

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...