236234 matches found
NPM: fast-uri vulnerable to path traversal via percent-encoded dot segments
NPM: fast-uri vulnerable to path traversal via percent-encoded dot segments vulnerability discovered by ? in WordPress Npm fast-uri versions = 3.1.0...
NPM: fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes
NPM: fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes vulnerability discovered by ? in WordPress Npm fast-xml-builder versions = 1.1.6...
Malicious code in tecken (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e7ecb06d2778fcefe87592b7fa63b3030929cd86f643ee6b03491bcf77ba4af The package tecken was found to contain malicious code. Source: ghsa-malware e46a4935556eec3dce9d7153106af36e724298f700938e068c4f5722e3622c02 Any...
Malicious code in msal-browser-1p (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b048f9df96df1367009fbcb80c4ad7b3ed89133bfe1fd86324c74e1c2d681c81 The package msal-browser-1p was found to contain malicious code. Source: ossf-package-analysis...
Malicious code in playgod (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0aee4818420709f0d12c4a32c97671628fffdb1255fefd1895b2c3f880f8b2b The package playgod was found to contain malicious code. Source: ossf-package-analysis a700663ab039dd35fa24734d883219fff845bb0c6017a5e0dcb0191dfa4676...
NPM: short-video-maker has a path traversal vulnerability
NPM: short-video-maker has a path traversal vulnerability discovered by ? in WordPress Npm short-video-maker versions = 1.3.4...
query-parser-string is vulnerable to Prototype Pollution
NPM package query-parser-string 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query parameters and merges them to the newly created object...
GHSA-54PG-9963-V8VG Compromised version of intercom-client published to npm
Impact On April 30, 2026, version 7.0.4 of intercom-client was published to npm using credentials obtained from a compromised developer account. This version was not produced by Intercom's build pipeline. The malicious version contained an obfuscated JavaScript payload that executed during packag...
CVE-2025-65122
Regex Denial of Service in youtube-regex npm package through version 1.0.5...
Malicious code in owa-analytics-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 644a42250298e29b58f2cfe75c1d362637e2c31f1a1ef9b9cfbe5d9ff0475fb8 The package owa-analytics-utils was found to contain malicious code. Source: ossf-package-analysis...
NPM: vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary
NPM: vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary vulnerability discovered by ? in WordPress Npm vm2 versions = 3.10.5...
MAL-2026-3363 Malicious code in mrdaa-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 757aca74d8d75ecde7421f2c632969a5b34c11a279d9d28b75755c2ca0825ceb The package mrdaa-frontend was found to contain malicious code. Source: ghsa-malware 0b6c586cd7adad52516658de8bbb3eb18f166350414f223fd73fe34a240d6948...
Malicious code in mrdaa-frontend (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 757aca74d8d75ecde7421f2c632969a5b34c11a279d9d28b75755c2ca0825ceb The package mrdaa-frontend was found to contain malicious code. Source: ghsa-malware 0b6c586cd7adad52516658de8bbb3eb18f166350414f223fd73fe34a240d6948...
GHSA-V2V4-37R5-5V8G vulnerabilities
Vulnerabilities for packages: prism, code-server, kubeflow-katib, renovate, langfuse, opensearch-dashboards, saf, pulumi, sqlpad, lerna, kubeflow-pipelines, tileserver-gl, npm...
CVE-2026-42338 vulnerabilities
Vulnerabilities for packages: prism, code-server, kubeflow-katib, renovate, langfuse, opensearch-dashboards, saf, pulumi, sqlpad, lerna, kubeflow-pipelines, tileserver-gl, npm...
GHSA-V2V4-37R5-5V8G vulnerabilities
Vulnerabilities for packages: gemini-cli, opensearch-dashboards-fips, wazuh-dashboard-fips, drupal, graalvm, pulumi, sqlpad, langfuse, kibana, code-server, tileserver-gl, kubeflow-pipelines, actions-runner, wazuh-dashboard, kubeflow-katib, langfuse-fips, opensearch-dashboards, librechat, saf,...
CVE-2026-42338 vulnerabilities
Vulnerabilities for packages: gemini-cli, opensearch-dashboards-fips, wazuh-dashboard-fips, drupal, graalvm, pulumi, sqlpad, langfuse, kibana, code-server, tileserver-gl, kubeflow-pipelines, actions-runner, wazuh-dashboard, kubeflow-katib, langfuse-fips, opensearch-dashboards, librechat, saf,...
PT-2026-38438
NPM package node-ts-ocr 1.0.15 is vulnerable to OS Command Injection via the invokeImageOcr function in src/index.js...
next-npm-version 1.0.1 安全漏洞
next-npm-version is a tool developed by Aric, a personal developer, for retrieving npm package versions. The version 1.0.1 of next-npm-version contains a security vulnerability, which stems from command injection...
