Astra Linux – Vulnerability in Node.js

There is an OS command injection vulnerability in Node.js versions 14.21.1, 16.18.1, 18.12.1, 19.0.1, due to an insufficient IsAllowedHost check. This vulnerability can be easily bypassed because the IsIPAddress function does not properly check whether an IP address is invalid before making DBS...

Astra Linux – Vulnerability in node-ini

This affects the package ini before version 1.3.6. If an attacker submits a malicious INI file to an application that parses it using ini.parse, they will corrupt the prototype within the application. This can be further exploited depending on the context...

CVE-2026-55102: Generation of Error Message Containing Sensitive Information

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError, which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These...

CVE-2026-78318: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Syncope. The notification message, as optionally shown by Console's and Enduser's login pages can be instructed to display HTML tags with unsafe JS inline, via malicious HTTP link generation...

Linux Distros Unpatched Vulnerability : CVE-2026-88060

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, a...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

js-yaml: js-yaml: Denial of Service via crafted YAML documents

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial o...

ROOT-APP-NPM-CVE-2022-25927 CVE-2022-25927 in ua-parser-js - Patched by Root

Root has patched CVE-2022-25927 in the ua-parser-js package for Root:npm. Multiple fixed versions available...

Malicious Package

Overview matrixkit-js is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the matrixkit-js packa...

Malicious Package

Overview graphql-js-client-transform is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors. Remediation Avoid using all malicious instances of the...

Security Bulletin: Vulnerability in js-yaml affects IBM Virtualization Engine TS7700

Summary IBM Virtualization Engine TS7700 is susceptible to a Privilege Escalation / Denial of Service CVE-2026-64718 threat due to the use of js-yaml. js-yaml is part of Node.js, which is used by TS7700 to provide the Management Interface. Vulnerability Details CVEID:CVE-2025-64718 DESCRIPTION:...

CLSA-2026-1788978094 TuxCare security update for js-yaml (1 CVE)

TuxCare rebuilt js-yaml to address 1 CVE. Fixed in 3.15.0-tuxcare.2...

Malicious code in matrixkit-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51238ce279c2ff37d32c5edd8a9cb480f1a304720cb67e5acf3ee50e91c773c4 The package advertises itself as a dense-matrix math library but its main entry matrix.js has been modified post-build to require'./src/init' and...

MAL-2026-16095 Malicious code in matrixkit-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51238ce279c2ff37d32c5edd8a9cb480f1a304720cb67e5acf3ee50e91c773c4 The package advertises itself as a dense-matrix math library but its main entry matrix.js has been modified post-build to require'./src/init' and...

Security Bulletin: Vulnerabilities found in Watson Data Intelligence

Summary Multiple Vulnerabilities were addressed in Watson Data Intelligence version 5.4.0 Patch6 Vulnerability Details CVEID:CVE-2026-59870 DESCRIPTION: js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts use...

Security Bulletin: Multiple vulnerabilities in IBM Aspera Faspex

Summary Multiple vulnerabilities were addressed in IBM Aspera Faspex 5.0.18 Vulnerability Details CVEID:CVE-2026-45819 DESCRIPTION: baseline-browser-mapping 2.x before 2.11.0 calls process.exit instead of throwing on invalid or conflicting input parameters, and can trigger immediate process...

MAL-2026-16086 Malicious code in graphql-js-client-transform (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c11b1672f9929aa10893cab85bc0f4e9a5ae5adfc2c8ae637d45e61b644692b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in graphql-js-client-transform (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c11b1672f9929aa10893cab85bc0f4e9a5ae5adfc2c8ae637d45e61b644692b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.46 security and extras update

Red Hat OpenShift Container Platform release 4.19.46 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a security impact of...

Malicious Package

Overview @usemosaik/template-react-js is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious...