Malicious code in browser-metrics-plugin.contrib (npm)

browser-metrics-plugin.contrib is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs node beacon.cjs on npm install,...

MAL-2026-17640 Malicious code in browser-metrics-plugin.contrib (npm)

browser-metrics-plugin.contrib is a dependency-confusion package: it is described as a "Compatibility shim", uses version numbers up to 99.0.1, and its README calls it an "authorized dependency-confusion test". Each listed version has a postinstall script that runs node beacon.cjs on npm install,...

EUVD-2026-94115

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion...

CVE-2026-93675 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion...

CVE-2026-93675 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion...

CVE-2026-93675

IBM Langflow OSS versions 1.0.0 through 1.12.2 are susceptible to a vulnerability that could allow a remote attacker to execute arbitrary code. The root cause is identified as an expected dependency confusion . The provided documents do not specify the exact component or file affected, nor do the...

PT-2026-107323

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description A remote attacker can execute arbitrary code due to dependency confusion. Dependency confusion is a software supply chain attack where a package manager is tricked into downloading a...

CVE-2026-93675: Expected Behavior Violation

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion...

PT-2026-107539

Name of the Vulnerable Software and Affected Versions praisonai-platform versions prior to 0.1.9 Description Issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member can delete a dependency from an owner-created issue by accessing it through a...

CVE-2026-62179: Missing Authorization

PraisonAI is a multi-agent teams system. In praisonai-platform prior to version 0.1.9, issue dependency deletion can be authorized against the wrong side of a dependency edge. A workspace member cannot delete a dependency through the owner-created issue endpoint, but can delete the same dependenc...

Malicious code in css-jptvix-polyfill (npm)

Source: amazon-inspector cea61788c370593a2720461d06b74942933d38d30b449851a05541b5b7f189aa The package ships thunderboltRegistry.js, a Proxy-based shim that exports names mimicking internal Wix thunderbolt modules thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry,...

Malicious code in lore-cs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84e496d81c3e514ec784db2d5996a9015fa9f01f50cb75a99011eb348b2aa07 lore-cs 1.0.0 executes an outbound HTTP POST both from setup.py at install time and from lorecs/init.py at import time to the hardcoded bare-IP...

MAL-2026-17639 Malicious code in lore-cs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84e496d81c3e514ec784db2d5996a9015fa9f01f50cb75a99011eb348b2aa07 lore-cs 1.0.0 executes an outbound HTTP POST both from setup.py at install time and from lorecs/init.py at import time to the hardcoded bare-IP...

ai.pipestream.module:module-opensearch-sink (>=0.1.2, <=0.1.4), ai.pipestream.module:module-testing-sidecar (0.0.1) +3573 more potentially affected by CVE-2026-106453 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.11.1)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =0.1.2, =0.0.22, =0.1.18, =0.1.7, =0.7.24, =0.7.24, =0.7.24, =0.1.29, =0.7.22, =0.7.12, =0.7.41 - ai.pipestream:repository-service 0.0.1 and more Source cves: CVE-2026-106453 Source advisory: MEND:CVE-2026-106453...

MAL-2026-17638 Malicious code in css-jptvix-polyfill (npm)

[email protected] was published to npm on 2026-10-06 07:29 UTC by user naorya and was unpublished by npm on 2026-10-06 15:04 UTC after a malware report. It is described as a CSS polyfill but contains no polyfill: index.js is an empty module, registry-manifest.min.json maps Wix-internal...

ai.pipestream.module:module-opensearch-sink (>=0.1.2, <=0.1.4), ai.pipestream.module:module-testing-sidecar (0.0.1) +3720 more potentially affected by CVE-2026-106451 via at.yawk.lz4:lz4-java (>=1.8.1, <=1.11.3)

at.yawk.lz4:lz4-java MAVEN version =1.8.1, =0.1.2, =0.0.22, =0.1.18, =0.1.7, =0.7.24, =0.7.24, =0.7.24, =0.1.29, =0.7.22, =0.7.12, =0.7.41 - ai.pipestream:repository-service 0.0.1 and more Source cves: CVE-2026-106451 Source advisory: MEND:CVE-2026-106451...

io.camunda:camunda-zeebe (>=8.9.0-alpha5-rc1, <=8.9.0-alpha5), io.camunda:tasklist-webapp (>=8.9.0-alpha5-rc1, <=8.9.0-alpha5) +15 more potentially affected by CVE-2026-103008 via org.elasticsearch:elasticsearch (>=8.12.0, <=8.19.22)

org.elasticsearch:elasticsearch MAVEN version =8.12.0, =8.9.0-alpha5-rc1, =8.9.0-alpha5-rc1, =main-272, =main-272, =main-272, =0.87.0, =7.25.0, =8.12.0.0, =8.12.0.0, =8.12.0.0, =8.12.0.0, =8.12.0, =8.12.0, =2.1, =3.0.0 - org.opennms.elasticsearch:elasticsearch-drift-plugin-8.18.2 2.0.7 and more...

io.camunda:camunda-zeebe (>=8.9.0-alpha5-rc1, <=8.9.0-alpha5), io.camunda:tasklist-webapp (>=8.9.0-alpha5-rc1, <=8.9.0-alpha5) +16 more potentially affected by CVE-2026-103008 via org.elasticsearch:elasticsearch-geo (>=8.12.0, <=8.19.22)

org.elasticsearch:elasticsearch-geo MAVEN version =8.12.0, =8.9.0-alpha5-rc1, =8.9.0-alpha5-rc1, =main-272, =main-272, =main-272, =0.87.0, =7.25.0, =8.12.0.0, =8.12.0.0, =8.12.0.0, =8.12.0.0, =8.12.0, =8.12.0, =8.12.0, =2.1, =3.0.0 and more Source cves: CVE-2026-103008 Source advisory:...

ai.hyacinth.framework:core-service-bus-support (>=0.5.0, <=0.5.24), ai.platon.pulsar:browser4-agent-tools (>=4.13.5, <=4.14.0-rc.2) +3403 more potentially affected by CVE-2026-106121 via com.rabbitmq:amqp-client (>=5.0.0, <=5.36.0)

com.rabbitmq:amqp-client MAVEN version =5.0.0, =0.5.0, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.13.5, =4.14.0-rc.2 - ai.platon.pulsar:browser4-seo 4.14.0-rc.2 and more Source cves: CVE-2026-106121 Source advisory:...

@bat-ai/core (>=0.1.0, <=0.1.4), @biztory/n8n-nodes-tableau-rest-api (>=0.1.13, <=0.1.14) +30 more potentially affected by CVE-2026-106119 via @langchain/mongodb (>=0.0.1, <=1.1.0)

@langchain/mongodb NPM version =0.0.1, =0.1.0, =0.1.13, =0.1.0, =2.35.2, =2.32.7, =2.32.0, =2.34.0, =1.0.5, =0.1.4, =1.0.0, =1.0.27 and more Source cves: CVE-2026-106119 Source advisory: MEND:CVE-2026-106119...