PT-2026-76888

Summary Terragrunt is vulnerable to an arbitrary file deletion flaw when downloading external modules. If a remote module contains a maliciously crafted .terragrunt-module-manifest file, Terragrunt can be tricked into deleting files anywhere on the local filesystem that the Terragrunt process has...

CVE-2026-59247 Insufficient verification of Hex package metadata in Gleam

Insufficient Verification of Data Authenticity vulnerability in Gleam allows an adversary in the middle to substitute forged Hex package contents during dependency resolution. During dependency resolution Gleam fetches package metadata from the signature-verified Hex repository, which covers each...

firefox: thunderbird: Unhandled Exception in Add-on Signature Verification

The Mozilla Foundation's Security Advisory: The application can fail to account for exceptions thrown by the loadManifestFromFile method during add-on signature verification. This flaw is triggered by an invalid or unsupported extension manifest and could cause runtime errors that disrupt the...

CVE-2026-38429

OpenCMS v20 and before is vulnerable to XML External Entity XXE in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml...

CVE-2026-38429

OpenCMS v20 and before is vulnerable to XML External Entity XXE in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml...

CVE-2026-38429

OpenCMS v20 and before is vulnerable to XML External Entity XXE in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml...

CVE-2026-28673

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the standard plugin system allows admins to upload a ZIP file containing a binary and a manifest.json. The server trusts the binaries field in the manifest and execute...

CVE-2026-28673

xiaoheiFS (self-hosted financial/operational system) versions ≤ 0.3.15 are vulnerable through the standard plugin system. An attacker can upload a ZIP containing a binary and a manifest.json; the server trusts the binaries field in the manifest and executes the specified file without validating i...

PT-2026-25970

xiaoheiFS is a self-hosted financial and operational system for cloud service businesses. In versions up to and including 0.3.15, the standard plugin system allows admins to upload a ZIP file containing a binary and a manifest.json. The server trusts the binaries field in the manifest and execute...

EUVD-2026-12085

JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection SSTI vulnerability exists in JumpServer's Applet and VirtualApp upload functionality. This vulnerability can only be exploited by users with administrative privileges...

MAL-2025-190150 Malicious code in view-omicron-unix-compress-authorize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d86eb2e159a609113cfc2efc8435ff741a9e4a3d864ae507fe6a729dd0058b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-184952 Malicious code in sonic-kas-fagiufagugafa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9a537d26a3f1602b0d32cd0629586d1858929097fd1dd03ca591b48867e6125 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in itale-adci-ggryuyegfjbu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c49bb2df6a5269b255f6360543df1a830c0ad775c6f1398eddbd88b8a21ef42 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181154 Malicious code in teate-thy-sonic-zuluf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d198dc0693a9d57cb4fcf20d4c644a5a1a662b95d255e2d4fa7f74603234d2a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-sonic-futfi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9069dc632d842e20a9ba5d0cd40085a754cfdc82ebf69f2427dc7e942ed583dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teate-thy-py-kopna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 350372ec686d2e9f3d5e3041efd1ae292241b88f94b8391dacabfd5194b3805d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-180993 Malicious code in teate-thy-sonic-tutato (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5037addecd0179ab192604db30cede8138b42b47a3391ce3403c48ca1f73e72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in goodafin-nuiya-gifia (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1279d7b7f18eba999c739ba9f3e9dbc33ff0006b8a10490d8bcb5dbca77acb8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nuilva-bavaim-macovo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05cc9559f6efdcbc4c48ca5c1433f4d5d1070185850de3a008165b4f8a19027c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-173406 Malicious code in buta-fbobna-giodaiaif (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aec892b68bc3ff0f73446293d7ebf7f00698a43128d568b62c81ecddcebbb8bb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...