31 matches found
@142vip/egg-grpc-client (>=0.0.1-alpha.3, <=0.0.1-alpha.4), @142vip/egg-grpc-server (>=0.0.1-alpha.3, <=0.0.1-alpha.5) +227 more potentially affected by CVE-2026-101915 via @grpc/grpc-js (>=1.14.0, <=1.14.4)
@grpc/grpc-js NPM version =1.14.0, =0.0.1-alpha.3, =0.0.1-alpha.3, =0.0.1-alpha.2, =0.26.4, =3.2.4, =1.13.0, =2.0.2, =0.1.0-alpha.0, =0.1.0, =2.1.0, =2.2.2, =2.0.0, =0.13.3, =0.0.4, =0.0.43 and more Source cves: CVE-2026-101915 Source advisory: SNYK:JS-GRPCGRPCJS-20251007...
com.squareup.wire:wire-grpc-client (>=7.0.0-alpha01, <=7.0.0-alpha03), com.squareup.wire:wire-schema (>=7.0.0-alpha01, <=7.0.0-alpha03) +1 more potentially affected by CVE-2026-45799 +1 more via com.squareup.wire:wire-runtime (>=7.0.0-alpha01, <=7.0.0-alpha03)
com.squareup.wire:wire-runtime MAVEN version =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha03 Source cves: CVE-2026-45799, CVE-2026-63126 Source advisory: OSV:GHSA-9RM7-3QHH-H2MC...
com.squareup.wire:wire-grpc-client (>=7.0.0-alpha01, <=7.0.0-alpha03), com.squareup.wire:wire-schema (>=7.0.0-alpha01, <=7.0.0-alpha03) +1 more potentially affected by CVE-2026-63126 via com.squareup.wire:wire-runtime (>=7.0.0-alpha01, <=7.0.0-alpha03)
com.squareup.wire:wire-runtime MAVEN version =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha03 Source cves: CVE-2026-63126 Source advisory: SNYK:JAVA-COMSQUAREUPWIRE-19964080...
com.squareup.wire:wire-grpc-client (>=7.0.0-alpha01, <=7.0.0-alpha03), com.squareup.wire:wire-schema (>=7.0.0-alpha01, <=7.0.0-alpha03) +1 more potentially affected by CVE-2026-45799 +1 more via com.squareup.wire:wire-runtime (>=7.0.0-alpha01, <=7.0.0-alpha03)
com.squareup.wire:wire-runtime MAVEN version =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha03 Source cves: CVE-2026-45799, CVE-2026-63126 Source advisory: GHSA-9RM7-3QHH-H2MC...
yakit v1.4.8-0821
YAKIT-A Cyber Security ALL-IN-ONE Platform based on Yak language Whitepaper • Official documentation • Issue feedback • Official website • Community • Architecture :book:Language： English • 中文 Introduction Security integration is a reform of security operations and management for enterprises in t...
yakit v1.4.8-0731
YAKIT-A Cyber Security ALL-IN-ONE Platform based on Yak language Whitepaper • Official documentation • Issue feedback • Official website • Community • Architecture :book:Language： English • 中文 Introduction Security integration is a reform of security operations and management for enterprises in t...
com.squareup.wire:com.squareup.wire.gradle.plugin (>=7.0.0-alpha01, <=7.0.0-alpha02), com.squareup.wire:wire-compiler (>=7.0.0-alpha01, <=7.0.0-alpha02) +11 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (>=7.0.0-alpha01, <=7.0.0-alpha02)
com.squareup.wire:wire-runtime-jvm MAVEN version =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha02 Source...
com.squareup.wire:wire-grpc-client (>=7.0.0-alpha01, <=7.0.0-alpha02), com.squareup.wire:wire-schema (>=7.0.0-alpha01, <=7.0.0-alpha02) +1 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (>=7.0.0-alpha01, <=7.0.0-alpha02)
com.squareup.wire:wire-runtime MAVEN version =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha02 Source cves: CVE-2026-45799 Source advisory: MEND:CVE-2026-45799...
Malicious code in github.com/BufferZoneCorp/grpc-client (Go)
--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security a4e4f74e90479d472a307d311d48214827e21cf93ecf9b0b62ff2cb72adb2c9e This package is a malicious packages part of the Go BufferZoneCorp and RubyGems knot-theory clusters. The packages in this cluster steal...
MAL-2026-4721 Malicious code in weavedb-node-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d174728fc7469b023ece1980797185c35abd74c56e253bc1dc1b295a46a1dbd2 package.json declares "preinstall": "./tools/setup", unconditionally executing a 976KB UPX-packed, stripped Linux x86 ELF on every npm install. The...
com.squareup.wire:wire-grpc-client (>=7.0.0-alpha01, <=7.0.0-alpha02), com.squareup.wire:wire-schema (>=7.0.0-alpha01, <=7.0.0-alpha02) +1 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (>=7.0.0-alpha01, <=7.0.0-alpha02)
com.squareup.wire:wire-runtime MAVEN version =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha02 Source cves: CVE-2026-45799 Source advisory: GHSA-7XPR-HC2W-34M9...
com.squareup.wire:com.squareup.wire.gradle.plugin (>=7.0.0-alpha01, <=7.0.0-alpha02), com.squareup.wire:wire-compiler (>=7.0.0-alpha01, <=7.0.0-alpha02) +11 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime-jvm (>=7.0.0-alpha01, <=7.0.0-alpha02)
com.squareup.wire:wire-runtime-jvm MAVEN version =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha02 Source...
com.squareup.wire:wire-grpc-client (>=7.0.0-alpha01, <=7.0.0-alpha02), com.squareup.wire:wire-schema (>=7.0.0-alpha01, <=7.0.0-alpha02) +1 more potentially affected by CVE-2026-45799 via com.squareup.wire:wire-runtime (>=7.0.0-alpha01, <=7.0.0-alpha02)
com.squareup.wire:wire-runtime MAVEN version =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha01, =7.0.0-alpha02 Source cves: CVE-2026-45799 Source advisory: OSV:GHSA-7XPR-HC2W-34M9...
Malicious Package
Overview github.com/BufferZoneCorp/grpc-client is a malicious package. This package contains malicious code designed to compromise developer systems and CI environments, specifically targeting GitHub Actions. The threat actor, operating under the GitHub account BufferZoneCorp, published a cluster...
CVE-2026-31863
Anytype Heart is the middleware library for Anytype. The challenge-based authentication for the local gRPC client API can be bypassed, allowing an attacker to gain access without the 4-digit code. This vulnerability is fixed in anytype-heart 0.48.4, anytype-cli 0.1.11, and Anytype Desktop 0.54.5...
CVE-2026-31863
Anytype Heart is the middleware library for Anytype. The challenge-based authentication for the local gRPC client API can be bypassed, allowing an attacker to gain access without the 4-digit code. This vulnerability is fixed in anytype-heart 0.48.4, anytype-cli 0.1.11, and Anytype Desktop 0.54.5...
CVE-2026-31863: Improper Restriction of Excessive Authentication Attempts
Anytype Heart is the middleware library for Anytype. The challenge-based authentication for the local gRPC client API can be bypassed, allowing an attacker to gain access without the 4-digit code. This vulnerability is fixed in anytype-heart 0.48.4, anytype-cli 0.1.11, and Anytype Desktop 0.54.5...
CVE-2026-26330 Envoy global rate limit may crash when the response phase limit is enabled and the response phase request is failed directly
Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, At the rate limit filter, if the response phase limit with applyonstreamdone in the rate limit configuration is enabled and the response phase limit request fails directly, it may crash Envoy. Whe...
CVE-2026-26330: Use After Free
Envoy is a high-performance edge/middle/service proxy. Prior to 1.37.1, 1.36.5, 1.35.8, and 1.34.13, At the rate limit filter, if the response phase limit with applyonstreamdone in the rate limit configuration is enabled and the response phase limit request fails directly, it may crash Envoy. Whe...
