@donmai/core (>=0.9.0, <=0.9.5), @donmai/mcp-server (>=0.9.0, <=0.9.5) +8 more potentially affected by CVE-2026-48816 via @sigstore/verify (3.1.0)

@sigstore/verify NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @sigstore/verify and may be impacted: - @donmai/core =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.62, =0.8.66 Source cves:...

MAL-2026-6710 Malicious code in vitest-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e0165cbb3d6ed37a96889c4b016463706346e1c09413635c31ea1ceedde8774 The package's postinstall script node lib/utils/index.js spawns a detached, stdio-suppressed Node child process that runs...

@briefhq/cli (>=0.1.6, <=0.1.11), @cobuild/review-gpt (>=0.5.10, <=0.5.96) +3 more potentially affected by CVE-2026-49987 via repomix (>=1.1.0, <=1.14.0)

repomix NPM version =1.1.0, =0.1.6, =0.5.10, =1.0.0, =0.63.0, =0.63.3 Source cves: CVE-2026-49987 Source advisory: OSV:GHSA-9MM9-RQHJ-J5MX...

PT-2026-55218

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.0.10 Description A race condition exists in the ShareHandler when processing share-link redemptions. The system reads the DownloadLimit of a share token using a read lock, releases it to serve the file, and only then...

nationstate-cyber-tools

NATION-STATE CYBER WEAPONS ARSENAL Live Web Page: htt...

com.github.manosbatsis.kmm.converters:kmm-converters-elide (1.0.0-alpha.2), com.github.manosbatsis.kmm.converters:kmm-converters-elide-autoconfigure (1.0.0-alpha.2) +42 more potentially affected by CVE-2026-57954 via com.yahoo.elide:elide-core (>=1.0.0.1, <=7.2.0)

com.yahoo.elide:elide-core MAVEN version =1.0.0.1, =1.0.0-alpha.3, =1.0.0-alpha.3, =1.0.0-alpha.3, =0.0.1, =2.3.0, =5.0.0, =5.0.0, =1.0.0.8, =1.0.0.6, =5.1.2 and more Source cves: CVE-2026-57954 Source advisory: SNYK:JAVA-COMYAHOOELIDE-17755935...

a-gpt (>=0.1.0, <=0.4.0), a11ywatch_cli (>=0.8.16, <=0.10.15) +2759 more potentially affected by unknown CVE via quick-xml (>=0.1.9, <=0.40.1)

quick-xml CARGO version =0.1.9, =0.1.0, =0.8.16, =0.3.1, =0.44.0, =0.1.0, =0.1.0, =0.2.0, =0.4.0, =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0194...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +14 more potentially affected by CVE-2026-59195 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =0.3.14 and more Source cves: CVE-2026-59195 Source advisory: SNYK:JS-PNPM-17660535...

@pnpm/bins.linker (>=1100.0.0, <=1100.0.10), @pnpm/bins.remover (>=1100.0.0, <=1100.0.6) +28 more potentially affected by CVE-2026-55699 via @pnpm/bins.resolver (>=1100.0.0, <=1100.0.5)

@pnpm/bins.resolver NPM version =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.24 and more Source cves: CVE-2026-55699 Source advisory:...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +14 more potentially affected by CVE-2026-55699 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =0.3.14 and more Source cves: CVE-2026-55699 Source advisory: SNYK:JS-PNPM-17661053...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +14 more potentially affected by CVE-2026-55698 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =0.3.14 and more Source cves: CVE-2026-55698 Source advisory: OSV:GHSA-W466-C33R-3GJP...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +14 more potentially affected by CVE-2026-50016 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =0.3.14 and more Source cves: CVE-2026-50016 Source advisory: OSV:GHSA-HWX4-2J3J-G496...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +14 more potentially affected by CVE-2026-48995 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =0.3.14 and more Source cves: CVE-2026-48995 Source advisory: OSV:GHSA-HG3W-7F8C-63HP...

@01.software/cli (>=0.1.1, <=0.10.3), @01.software/sdk (>=0.0.1-251008.90016, <=0.29.0) +140 more potentially affected by CVE-2026-11779 via payload (>=0.8.2, <=4.0.0-internal.9726517)

payload NPM version =0.8.2, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.1, =1.0.1-beta.0, =1.0.1, =0.1.0, =0.1.0, =0.1.1 - @doubledigit/payload 0.1.1 and more Source cves: CVE-2026-11779 Source advisory: SNYK:JS-PAYLOAD-17660977...

CVE-2026-9222 Setracker2 Children's Smartwatch Ecosystem Use of password hash instead of password for authentication

Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authenticating with backend services from the client. This could allow an attacker, who knows the hash, to authenticate and gain full access...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +14 more potentially affected by CVE-2026-55180 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =0.3.14 and more Source cves: CVE-2026-55180 Source advisory: SNYK:JS-PNPM-17874446...

Malicious code in rstreams-metrics (npm)

The rstreams-metrics npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

MAL-2026-6423 Malicious code in leo-connector-elasticsearch (npm)

The leo-connector-elasticsearch npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the...

Malicious code in serverless-leo (npm)

The serverless-leo npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

MAL-2026-6424 Malicious code in leo-connector-mongo (npm)

The leo-connector-mongo npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the...