MAL-2026-16102 Malicious code in mfatest2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dea6c92bd37f4ff11dfa24ad1415d1a01351ee62baf37718a7c10362d393c15 package.json declares its only runtime dependency as an unpinned GitHub ref "node-net-pool": "github:trktgq0wbre1/node-net-pool" pointing at a...

Malicious code in mfatest2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dea6c92bd37f4ff11dfa24ad1415d1a01351ee62baf37718a7c10362d393c15 package.json declares its only runtime dependency as an unpinned GitHub ref "node-net-pool": "github:trktgq0wbre1/node-net-pool" pointing at a...

GHSA-6R2R-WW24-7H52 vulnerabilities

Vulnerabilities for packages: mlflow, datahub-ingestion, opal, awx, checkov, datahub-ingestion-fips...

@0xsequence/codegenie (>=0.1.0, <=0.5.1), @2h2d/new (>=0.0.2, <=0.1.1-alpha.3) +769 more potentially affected by CVE-2026-85730 via smol-toml (>=1.1.2, <=1.7.0)

smol-toml NPM version =1.1.2, =0.1.0, =0.0.2, =1.0.0, =0.10.0, =4.10.0, =0.1.3, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.0, =0.29.4 and more Source cves: CVE-2026-85730 Source advisory: OSV:GHSA-7W5X-HRQM-74C2...

almos-kit (>=0.1.1, <=1.2.0), bas-air-unit-network-dataset (>=0.5.0, <=0.5.1) +15 more potentially affected by CVE-2026-55073 via weasyprint (63.1.0)

weasyprint PYPI version 63.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - almos-kit =0.1.1, =0.5.0, =0.0.3, =2.2.0, =3.3.6, =0.3.17, =0.1.2, =0.1.1, =0.10.0, =0.3.3, =2.0.0, =0.9.0, =0.14.0 - textpress 0.1.2 and...

coreason-scribe (>=0.1.0, <=0.3.0), django-afip (>=5.0.0, <=14.1.0) +8 more potentially affected by CVE-2026-55073 via weasyprint (67.0.0)

weasyprint PYPI version 67.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - coreason-scribe =0.1.0, =5.0.0, =6.0.0, =0.1.0, =1.3.0, =1.1.7.post1, =1.2.1, =0.1.0, =2.11.0, =2.11.1 Source cves: CVE-2026-55073 Source...

mpi-cbs-mediforms (0.1.0a2) potentially affected by CVE-2026-55073 via weasyprint (58.0.0)

weasyprint PYPI version 58.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - mpi-cbs-mediforms 0.1.0a2 Source cves: CVE-2026-55073 Source advisory: OSV:GHSA-JF6Q-CHMF-3H3V...

blabel (0.1.5), pdf-reports (>=0.3.3, <=0.3.4) potentially affected by CVE-2026-55073 via weasyprint (52.0.0)

weasyprint PYPI version 52.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - blabel 0.1.5 - pdf-reports =0.3.3, =0.3.4 Source cves: CVE-2026-55073 Source advisory: OSV:GHSA-JF6Q-CHMF-3H3V...

lightnovel-crawler (>=2.7.15, <=2.10.1) potentially affected by CVE-2026-55073 via weasyprint (45.0.0)

weasyprint PYPI version 45.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - lightnovel-crawler =2.7.15, =2.10.1 Source cves: CVE-2026-55073 Source advisory: OSV:GHSA-JF6Q-CHMF-3H3V...

antipetros-discordbot (>=0.1.0, <=0.1.7) potentially affected by CVE-2026-55073 via weasyprint (52.2.0)

weasyprint PYPI version 52.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - antipetros-discordbot =0.1.0, =0.1.7 Source cves: CVE-2026-55073 Source advisory: OSV:GHSA-JF6Q-CHMF-3H3V...

body-organ-analysis (>=0.1.0, <=0.1.5), brena (>=0.0.1, <=0.0.2) +30 more potentially affected by CVE-2026-55073 via weasyprint (52.5.0)

weasyprint PYPI version 52.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - body-organ-analysis =0.1.0, =0.0.1, =0.1.0, =22.16.0, =1.0.0, =24.0.0, =1.1.3, =4.2.1, =0.2.1a0, =25.0.13, =1.0.2.post1, =0.0.1, =1.2.1,...

MAL-2026-16082 Malicious code in @umschool/platform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcf64895a777467cc94763bfb942be3c04040ca151fc22753ca48ac4aaecd69c @umschool/[email protected] is published to public npm under an internal-looking scope with an implausibly high version number, a resolution shape use...

Malicious code in @umschool/platform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcf64895a777467cc94763bfb942be3c04040ca151fc22753ca48ac4aaecd69c @umschool/[email protected] is published to public npm under an internal-looking scope with an implausibly high version number, a resolution shape use...

EUVD-2023-60623

PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server...

at.chrl:chrl-jms (1.1.0), at.researchstudio.sat:won-core (>=0.2, <=0.9) +1152 more potentially affected by CVE-2026-74761 via org.apache.activemq:activemq-broker (>=5.8.0, <=5.19.10)

org.apache.activemq:activemq-broker MAVEN version =5.8.0, =0.2, =0.3, =0.2, =0.2, =0.3, =0.3, =0.3, =0.3, =0.3, =0.2, =0.3, =0.3, =0.6 - at.researchstudio.sat:won-owner 0.3 - at.researchstudio.sat:won-owner-webapp 0.3 and more Source cves: CVE-2026-74761 Source advisory:...

cabrita (>=2.2.2b1, <=2.2.2b2), cico (>=0.1.0, <=0.1.8) +4 more potentially affected by CVE-2026-87819 via gitpython (2.1.10)

gitpython PYPI version 2.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - cabrita =2.2.2b1, =0.1.0, =0.1.0, =3.11.1, =0.9.0, =0.9.7.2 Source cves: CVE-2026-87819 Source advisory: OSV:PYSEC-2026-3984...

fips-md (0.3.0) potentially affected by unknown CVE via aligned_box (0.2.1)

alignedbox CARGO version 0.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on alignedbox and may be impacted: - fips-md 0.3.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0282...

ROOT-APP-NPM-GHSA-8X6C-CV3V-VP6G GHSA-8x6c-cv3v-vp6g in cacheable-request - Patched by Root

Root has patched GHSA-8x6c-cv3v-vp6g in the cacheable-request package for Root:npm. Multiple fixed versions available...

@adobe/aem-site-template-builder (>=0.1.7, <=2.0.2), @ns3/nx-serverless (>=3.2.2, <=4.1.0) +4 more potentially affected by CVE-2026-87794 via bestzip (>=2.1.6, <=2.2.1)

bestzip NPM version =2.1.6, =0.1.7, =3.2.2, =0.3.0, =1.0.7-6, =1.0.2-1, =1.0.0, =1.0.2 Source cves: CVE-2026-87794 Source advisory: SNYK:JS-BESTZIP-19653586...

@bigegg/parse-server-schema-config (>=1.0.5, <=1.0.10), @kontaa/subgraph (>=1.0.1, <=1.2.3) +8 more potentially affected by CVE-2026-87806 via parse-server (>=3.10.0, <=7.5.4)

parse-server NPM version =3.10.0, =1.0.5, =1.0.1, =1.2.1, =2.4.46, =1.0.0, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =1.1.0 - servable-publishable 1.1.0 Source cves: CVE-2026-87806 Source advisory: MEND:CVE-2026-87806...