20845 matches found
MAL-2026-6723 Malicious code in electron-orbit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7faf51a6c9d6ed9fce8cf9de9ea8afee0e9c3dc1fb254e8cd0c3c2a8ca61323f On require'electron-orbit', the module unconditionally fires an auto-prefetch pipeline in Node contexts when no document is present that opens a raw...
MAL-2026-6724 Malicious code in starlette-healthcheck (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45d8da59826f5074d5b65d3b4733a4da6e7ce20167db9c14f7004e5fb7abe273 The package presents itself as an ASGI healthcheck/request-logging utility, but its advertised configurelogging helper exposed from the top-level...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization in the valuesFrom process. An attacker can gain unauthorized access to secrets and config maps across namespaces by crafting resources such as HelmOp or Bundle with references to arbitrary secrets, provided they...
Malicious code in ts-eslint-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5bbed232e0268a791ce846260ce170342eec359bf1a7e84b9514767d77803a1 The package's index.js defines run/fromstr that recursively walk process.cwd and match files named.env, env, id.json, config.json, config.toml,...
Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
Description The per-template filter, tag and function allow-list check is compiled into the checkSecurity method of each Template subclass and was invoked once from the constructor, gated by SandboxExtension::isSandboxed$source. Template instances are then cached on the Environment in...
Unsafe Dependency Resolution
Overview neuro-cortex-memory is a Scientifically-grounded memory system based on computational neuroscience research Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the CLAUDEPROJECTDIR environment variable, which is treated as a trusted source directory witho...
CVE-2026-14330
Multiple unbounded alloca calls in the PulseAudio protocol server...
CVE-2026-58035
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Block/SpecialBlock.Vue...
GHSA-HJV3-X37X-J8JM vulnerabilities
Vulnerabilities for packages: firefox...
GHSA-G2FH-3663-3JF8 vulnerabilities
Vulnerabilities for packages: firefox-esr, firefox...
GHSA-C4G9-Q4RC-577F vulnerabilities
Vulnerabilities for packages: firefox...
GHSA-GVHP-5J8M-528X vulnerabilities
Vulnerabilities for packages: firefox...
GHSA-V49M-R4W3-2P5X vulnerabilities
Vulnerabilities for packages: firefox-esr, firefox...
GHSA-2W9W-FGQ6-2VMC vulnerabilities
Vulnerabilities for packages: firefox...
GHSA-3PP7-M8F5-89GX vulnerabilities
Vulnerabilities for packages: firefox-esr, firefox...
GHSA-G34X-MGC7-JQCH vulnerabilities
Vulnerabilities for packages: firefox-esr, firefox...
GHSA-J3CH-R4QX-FPVF vulnerabilities
Vulnerabilities for packages: firefox-esr, firefox...
GHSA-VPV3-WPRV-R8G5 vulnerabilities
Vulnerabilities for packages: chromium...