pdfjs-vuln-demo

PDF.js Vulnerability Demo Project This project is intended to serve as a proof of concept to demonstrate exploiting the vulnerability in the PDF.js pdfjs-dist library reported in CVE-2024-4367 Getting Things Running Fork and clone from this repository npm install npm run dev Testing Things Out...

amavis

Installation Use your system's amavis package if possible. Prerequisites Software dependencies are tracked via Dist::Zilla. Some of them involve non-perl development libraries and GCC as a build dependency if obtained from CPAN: libdb libidn2 libssl libzmq3 On Debian 13 for example, one can insta...

pdfjs-vuln-demo

PDF.js Vulnerability Demo Project This project is intended to serve as a proof of concept to demonstrate exploiting the vulnerability in the PDF.js pdfjs-dist library reported in CVE-2024-4367 Getting Things Running Fork and clone from this repository npm install npm run dev Testing Things Out...

GHSA-HHXQ-47XX-J5XX virtualenv: Seed replacement does not contain metadata deletion paths

Summary The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment. Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026...

virtualenv: Seed replacement does not contain metadata deletion paths

Summary The app-data seeder joins paths from existing distribution metadata to site-packages and deletes the resulting paths without checking containment within the environment. Anthropic's OSS Scanner reported this as ANT-2026-SXOEHWP7 in virtualenv-20261015-005, received on 15 October 2026...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.1, <=3.4.2) potentially affected by CVE-2026-71896 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.1, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.1, =3.4.1, =3.4.2 Source cves: CVE-2026-71896 Source advisory: MEND:CVE-2026-71896...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.0, <=3.4.2) potentially affected by CVE-2026-71895 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.0, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.0, =3.4.0, =3.4.2 Source cves: CVE-2026-71895 Source advisory: MEND:CVE-2026-71895...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.0, <=3.4.2) potentially affected by CVE-2026-71183 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.0, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.0, =3.4.0, =3.4.2 Source cves: CVE-2026-71183 Source advisory: MEND:CVE-2026-71183...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.0, <=3.4.2) potentially affected by CVE-2026-66087 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.0, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.0, =3.4.0, =3.4.2 Source cves: CVE-2026-66087 Source advisory: MEND:CVE-2026-66087...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.0, <=3.4.2) potentially affected by CVE-2026-66084 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.0, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.0, =3.4.0, =3.4.2 Source cves: CVE-2026-66084 Source advisory: MEND:CVE-2026-66084...

org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.4.0, <=3.4.2) potentially affected by CVE-2026-66082 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.4.0, <=3.4.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.4.0, =3.4.0, =3.4.2 Source cves: CVE-2026-66082 Source advisory: MEND:CVE-2026-66082...

Malicious code in dotenv-runtime (npm)

Source: amazon-inspector 50639fcdb3317812a161b8f54fbf22d2565881af534da0d2ec8f7d37ecbd3f3b The package presents itself as a dotenv parser but on require index.cjs calls a function named dispatchAnalytics that reads dist/stest.jpg, extracts a hidden string from the JPEG APP13 EXIF segment, writes a...

MAL-2026-17657 Malicious code in dotenv-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50639fcdb3317812a161b8f54fbf22d2565881af534da0d2ec8f7d37ecbd3f3b The package presents itself as a dotenv parser but on require index.cjs calls a function named dispatchAnalytics that reads dist/stest.jpg, extracts ...

Malicious code in dotenv-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50639fcdb3317812a161b8f54fbf22d2565881af534da0d2ec8f7d37ecbd3f3b The package presents itself as a dotenv parser but on require index.cjs calls a function named dispatchAnalytics that reads dist/stest.jpg, extracts ...

Malicious code in virgil-cli (npm)

In local mode virgil-cli prints that it runs on the user's machine and is free and private. After each turn, reportLearning in dist/api.js posts the whole conversation history, including shell and file tool output, to https://api.nm-streetwear.space/vx/learn with a hardcoded token and a device id...

SUSE CVE-2026-104848

Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal options object and reads the execArgv and env worker options in dist/index.js, allowing values inherited from a polluted Object.prototype to be copied into own...

Malicious code in dotenv-promises (npm)

Source: amazon-inspector 254f0bcbb8014fb07414eb0b41a898deac682aa8c8b7a8541a0f7538ac274f9a The package is published as 'dotenv-promises' but its bundled manifest declares the internal name '[email protected]' and mimics the dotenv API config/parse/populate/expand to attract installs of a...

Malicious code in dotenv-async (npm)

Source: amazon-inspector 51d22963a1f1fabe3a8b3f54efcb5053761d385486093200765745297ac2bd16 The package impersonates the dotenv API but on module load and again when the bundled CLI runs invokes a function named dispatchAnalytics in dist/index.cjs that extracts a payload from the APP14 0xFFED marke...

PT-2026-115374

Summary parse has a quadratic-time path in parseKey, reachable on default options with ordinary valid input. For every key line and table-header line, parseKey dist/struct.js, lines 58 and 86 finds the dotted-key separator with ctx.s.indexOf'.', ctx.p, where ctx.s is the whole document. When a ke...

Malicious code in dotenv-promises (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 254f0bcbb8014fb07414eb0b41a898deac682aa8c8b7a8541a0f7538ac274f9a The package is published as 'dotenv-promises' but its bundled manifest declares the internal name '[email protected]' and mimics the dotenv API...