JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution...

GHSA-6C59-MWGH-R2X6 JSONPath vulnerable to Prototype Pollution due to insufficient input validation of object keys in lib/index.js

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution...

Malicious code in converse-rn-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5d76925473e0e05137943f3ba72835d43a14fecbcd07a36ff4f8b362342a303 The package converse-rn-lib was found to contain malicious code. Source: ghsa-malware 2d5c359e434d151a2156ad29e2d3b287cd665dd67ede66ac8c32a968f2ebaef...

Malicious Package

Overview converse-rn-lib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-565 Malicious code in converse-rn-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5d76925473e0e05137943f3ba72835d43a14fecbcd07a36ff4f8b362342a303 The package converse-rn-lib was found to contain malicious code. Source: ghsa-malware 2d5c359e434d151a2156ad29e2d3b287cd665dd67ede66ac8c32a968f2ebaef...

Malicious Package

Overview blockchain-helper-lib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2025-61140

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution...

EUVD-2025-206486

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution...

CVE-2025-57283

The Node.js package browserstack-local version 1.5.8 is vulnerable to a command injection vulnerability. The root cause is the improper sanitization of the logfile variable within the lib/Local.js library. An attacker could exploit this to execute arbitrary commands on the host system. Remediatio...

PT-2026-6418

The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js...

CVE-2025-61140

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution...

PT-2026-6378

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution...

CVE-2025-61140: Improperly Controlled Modification of Object Prototype Attributes

The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution...

CVE-2025-57283: Improper Control of Generation of Code

The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in lib/Local.js...

CVE-2026-24803

CVE-2026-24803 describes an infinite loop (unreachable exit condition) vulnerability in coolsnowwolf/lede within the MT7615D wifi drivers under mt_wifi/embedded/security modules, specifically associated with bn_lib.C. Affected software: LEDE project releases up to and including r25.10.1. Root cau...

CVE-2026-23002

In the Linux kernel, the following vulnerability has been resolved: lib/buildid: use kernelread for sleepable context Prevent a "BUG: unable to handle kernel NULL pointer dereference in filemapreadfolio". For the sleepable context, convert freader to use kernelread instead of direct page cache...

CVE-2026-23002: NULL Pointer Dereference

In the Linux kernel, the following vulnerability has been resolved: lib/buildid: use kernelread for sleepable context Prevent a "BUG: unable to handle kernel NULL pointer dereference in filemapreadfolio". For the sleepable context, convert freader to use kernelread instead of direct page cache...

golang security update

1.25.5-1 - Update to Go 1.25.5 fips-1 1.25.3-5 - gating.yaml: Add tier1 s390x tests 1.25.3-4 - Cleanup lib/ ownership - Remove legacy logic forcing lib/ into golang-tests - Move lib/wasm, lib/fips140, and lib/time to main golang package - Fixes gojswasmexec availability 1.25.3-3 - plans/tier0.fmf...

Malicious code in private-payment-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96c4346497d58e1d5eca5c47353d4491578827b6095eb0f62dc7ff4449c0758b The package private-payment-lib was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview private-payment-lib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...