267277 matches found
@fallow-cli/fallow-node (>=3.0.0, <=3.33.1) potentially affected by CVE-2026-115569 via @fallow-cli/fallow-node-win32-x64-msvc (>=3.0.0, <=3.33.1)
@fallow-cli/fallow-node-win32-x64-msvc NPM version =3.0.0, =3.0.0, =3.33.1 Source cves: CVE-2026-115569 Source advisory: MEND:CVE-2026-115569...
@fallow-cli/fallow-node (>=3.0.0, <=3.33.1) potentially affected by CVE-2026-115569 via @fallow-cli/fallow-node-darwin-arm64 (>=3.0.0, <=3.33.1)
@fallow-cli/fallow-node-darwin-arm64 NPM version =3.0.0, =3.0.0, =3.33.1 Source cves: CVE-2026-115569 Source advisory: MEND:CVE-2026-115569...
@fallow-cli/fallow-node (>=3.0.0, <=3.33.1) potentially affected by CVE-2026-115569 via @fallow-cli/fallow-node-darwin-x64 (>=3.0.0, <=3.33.1)
@fallow-cli/fallow-node-darwin-x64 NPM version =3.0.0, =3.0.0, =3.33.1 Source cves: CVE-2026-115569 Source advisory: MEND:CVE-2026-115569...
@fallow-cli/fallow-node (>=3.0.0, <=3.33.1) potentially affected by CVE-2026-115569 via @fallow-cli/fallow-node-linux-arm64-musl (>=3.0.0, <=3.33.1)
@fallow-cli/fallow-node-linux-arm64-musl NPM version =3.0.0, =3.0.0, =3.33.1 Source cves: CVE-2026-115569 Source advisory: MEND:CVE-2026-115569...
@fallow-cli/fallow-node (>=3.0.0, <=3.33.1) potentially affected by CVE-2026-115569 via @fallow-cli/fallow-node-linux-arm64-gnu (>=3.0.0, <=3.33.1)
@fallow-cli/fallow-node-linux-arm64-gnu NPM version =3.0.0, =3.0.0, =3.33.1 Source cves: CVE-2026-115569 Source advisory: MEND:CVE-2026-115569...
GHSA-P3HM-X653-5RC6 vulnerabilities
Vulnerabilities for packages: unleash, wazuh-dashboard-fips, lerna, actions-runner, unleash-proxy, prism, npm, wazuh-dashboard, node-red, homepage, eco-jess, code-server...
CVE-2026-111997 vulnerabilities
Vulnerabilities for packages: unleash, wazuh-dashboard-fips, lerna, actions-runner, unleash-proxy, prism, npm, wazuh-dashboard, node-red, homepage, eco-jess, code-server...
CVE-2026-99075
In the Linux kernel, the following vulnerability has been resolved: rustbinder: reschedule node refcount update on thread exit When a thread exits via BINDERTHREADEXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferred...
MSC-2026-13025
Fourteen npm packages published from throwaway accounts in the testmetest campaign install a self-propagating, Shai-Hulud-derived worm. Most of them use a command expansion in binding.gyp that makes node-gyp execute an obfuscated index.js loader at install time; the payload steals SSH keys,...
PT-2026-122030
In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipc node find by name returns a node after dropping its RCU read lock without taking a reference. The LINK SET, LINK GET and LINK RESET STATS handlers then lock and access the...
CVE-2026-89419
A flaw was found in OpenStack Ironic. A missing authorization check in the node PATCH API allows an authenticated lessee member to change the maintenance state of a bare metal node, an operation that should be restricted to lessee managers and administrators. By sending a PATCH request to...
Malware in @lumen-labs-dev/whisper-node
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in @lumen-labs-dev/whisper-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9643145fda005627c853ce885fce2cba3f7c4ad008b8e3925fc2639b270567b The package was scanned and no a static rule matches or traced behaviors indicating supply-chain attack patterns were observed. No lifecycle scripts...
MAL-2026-18194 Malicious code in @lumen-labs-dev/whisper-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9643145fda005627c853ce885fce2cba3f7c4ad008b8e3925fc2639b270567b The package was scanned and no a static rule matches or traced behaviors indicating supply-chain attack patterns were observed. No lifecycle scripts...
Malicious Package
Overview @lumen-labs-dev/whisper-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
EUVD-2026-107553
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype...
GHSA-H895-CGQG-JF52 toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
Summary CVE-2026-63376 described prototype pollution through proto key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the...
toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
Summary CVE-2026-63376 described prototype pollution through proto key-path desynchronization and was fixed in 4.1.2 by rewriting the path bookkeeping and adding an ownedContainers WeakSet. The desynchronization is still reachable, spelled with a quote character instead of a dot, and the...
npm: toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
npm: toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype vulnerability discovered by ? in WordPress npm tome versions = 5.0.0...