267838 matches found
CVE-2026-66069: Missing Authorization
RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, isauthorized/2 uses isauthorizedmonitor for all methods. DELETE resets rabbitcoremetrics:resetauthattemptmetrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbitmgmtwmreset.erl...
PT-2026-97557
Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 4.1.13 RabbitMQ versions prior to 4.2.7 RabbitMQ versions prior to 4.3.0 Description An issue exists where the is authorized/2 function uses is authorized monitor for all methods. This allows a user with the monitori...
PT-2026-105057
RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is authorized/2 uses is authorized monitor for all methods. DELETE resets rabbit core metrics:reset auth attempt metrics. Impact is cosmetic counters only, no log erasure, but inconsistent with rabbit mgmt w...
PT-2026-105248
Security vulnerability affects the vault package. Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node...
Malicious code in @tvg-mar/promos-gtm (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4ce7a8a15cabec2c11f60085a7b3bac2cc905ef037e5ce28d6dd3dd847ef28 @tvg-mar/[email protected] executes an out-of-band DNS exfiltration routine both at install time via a scripts.install hook running node index.js and...
CVE-2026-92708
A flaw was found in devalue, a JavaScript library for serializing values. The stringify and uneval functions incorrectly serialize Node Buffers by emitting the entire backing ArrayBuffer instead of only the view. This vulnerability allows for the disclosure of up to 64 KB of unrelated process...
EUVD-2026-84005
KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join...
EUVD-2026-84032
KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes...
Malicious code in node-env-buffer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0011ed2fd25fdc35a89f50c2eb1d7d895210908c637be0fcaca077d032baaee6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malware in node-env-buffer
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
MAL-2026-16403 Malicious code in node-env-buffer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0011ed2fd25fdc35a89f50c2eb1d7d895210908c637be0fcaca077d032baaee6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
Malicious Package
Overview node-env-buffer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
EUVD-2026-84559
FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/service/common/api/axios.ts validates a hostname with isInternalAddress before a later HTTP connection performs an independent DNS lookup,...
Malicious code in @mr-supun-fernando/supunmd-bail (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86c68c82f6ead4ab3b823b81fd6805991bfdd65cdc901d83aeb561cdd8f27b19 package.json declares "libsignal": "github:tenka-san/libsignal-node" — an off-registry dependency source pointing at a personal-user GitHub repositor...
jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: Jboss Deserialization RCE via Unfiltered River Unmarshaller
A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node...
ROOT-APP-NPM-AIKIDO-2026-10843 AIKIDO-2026-10843 in vm2 - Patched by Root
Root has patched AIKIDO-2026-10843 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-10689 AIKIDO-2026-10689 in vm2 - Patched by Root
Root has patched AIKIDO-2026-10689 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-10840 AIKIDO-2026-10840 in vm2 - Patched by Root
Root has patched AIKIDO-2026-10840 in the vm2 package for Root:npm. Multiple fixed versions available...