PT-2026-51113

Name of the Vulnerable Software and Affected Versions Craft CMS versions 4.0.0-RC1 through 4.17.9 Craft CMS versions 5.0.0-RC1 through 5.9.9 Description Craft CMS is subject to Server-Side Request Forgery SSRF and Arbitrary JavaScript Injection via the '/actions/app/resource-js' endpoint. The iss...

Fedora 45 : nginx / nginx-mod-brotli / nginx-mod-fancyindex / etc (2026-e212182e6e)

The remote Fedora 45 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2026-e212182e6e advisory. nginx-mod-brotli: - Rebuild for 1.30.3 nginx-mod-fancyindex: - Rebuild for 1.30.3 nginx-mod-modsecurity: - Rebuild for 1.30.3 nginx-mod-headers-more...

ALPINE-CVE-2026-48937

A flaw in Node.js HTTP/2 server API can cause servers to keep accepting data even after sending a GOAWAY frame. This vulnerability affects two supported release lines: Node.js 22 and Node.js 24...

ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`

A flaw was found in ws, an open source WebSocket client and server for Node.js. The websocket.close implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memor...

145 Mastra npm Packages Compromised via Hijacked Contributor Account

As many as 145 npm packages associated with the Mastra namespace "@mastra/", a popular open-source JavaScript and TypeScript framework for building artificial intelligence AI applications, have been compromised as part of a software supply chain attack codenamed easy-day-js , per findings from...

ROOT-APP-NPM-CVE-2026-48068 CVE-2026-48068 in @rootio/grpc__grpc-js - Patched by Root

Root has patched CVE-2026-48068 in the @rootio/grpcgrpc-js package for Root:npm. Multiple fixed versions available...

Malicious code in @mastra/client-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e455eddde2f8d9fc5c241cf6715800d34191e53b6fd5ddd7f156398755f252e3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6007 Malicious code in @mastra/client-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e455eddde2f8d9fc5c241cf6715800d34191e53b6fd5ddd7f156398755f252e3 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5988 Malicious code in params-valid-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 397af72237ba3626ac4727497662530f602c2ce6ec71406f48b508055687366c The package presents itself as 'Simplified HTTP request client' and copies identity metadata from Mikeal Rogers' legitimate request package bugs URL...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minute burst starting around 01:12 UTC, republished the entire @mastra catalog. The Mastra source code was...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minute burst starting around 01:12 UTC, republished the entire @mastra catalog. The Mastra source code was...

CVE-2026-53864

OpenClaw before 2026.5.26 contains an insufficient sanitization vulnerability in the host environment sanitizer that allows Node.js control variables to bypass validation. Attackers with access to workspace .env files, tool environment overrides, or skill environment blocks can pass malicious...

Malicious code in mastraqqq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ab6891e53f407a1aebddb94c7d02dab202313f4576e37f378dfc2fc50705cd4 Package is published as mastraqqq but bundles a verbatim clone of the legitimate mastra CLI: the embedded package metadata declares name: "mastra",...

MAL-2026-5913 Malicious code in mastraqqq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ab6891e53f407a1aebddb94c7d02dab202313f4576e37f378dfc2fc50705cd4 Package is published as mastraqqq but bundles a verbatim clone of the legitimate mastra CLI: the embedded package metadata declares name: "mastra",...

MAL-2026-5892 Malicious code in caspian-day-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 895fe8e087ec7af36d61e8a6972f484e70bc1b828374ae83cef9ff4a927f7b55 caspian-day-js impersonates the popular dayjs package: package.json copies author iamkun, homepage day.js.org, and repo github.com/iamkun/dayjs.git,...

MAL-2026-5878 Malicious code in cache-compat-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70fc75889476bd737b302c856fb1d2da1b263a93786bc27fed3978c3eb0584cd The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

SUSE CVE-2026-49982

tmp is a temporary file and directory creator for node.js. In version 0.2.6, the assertPath guard added to tmp rejects only string values that contain the substring ... It is bypassed when prefix, postfix, or template is supplied as a non-string value Array, Buffer, or any object whose includes'....

CVE-2026-48886

Unauthenticated SQL Injection in JS Help Desk = 3.0.9 versions...

CVE-2026-48887

Unauthenticated Broken Access Control in JS Help Desk = 3.0.9 versions...

UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`

Summary A regular expression denial-of-service ReDoS vulnerability has been discovered in ua-parser-js when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParserheaders.withClientHints, an attacker can cause the parser to spend excessive CPU...