Lucene search
+L

255441 matches found

OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/14 7:53 p.m.26 views

Malicious code in assertion-utils-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 311d22d9694863456136cf4f8b69a291fdbb631eda56bafca1959e0c184774a1 assertion-utils-js is a typosquat of chai name, description, and keywords mirror the real package. On require, index.js spawns a detached Node child...

6.2AI score
SaveExploits0References2
OSV
OSV
added 2026/07/14 7:53 p.m.11 views

MAL-2026-10612 Malicious code in assertion-utils-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 311d22d9694863456136cf4f8b69a291fdbb631eda56bafca1959e0c184774a1 assertion-utils-js is a typosquat of chai name, description, and keywords mirror the real package. On require, index.js spawns a detached Node child...

6.2AI score
SaveExploits0References2
OSV
OSV
added 2026/07/14 5:56 p.m.10 views

MAL-2026-10609 Malicious code in utils-style-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3049309c5f74bd1b453bcd51803cb7b8ddbbab2d3038f10d13e11a592dff6f52 The package declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, uid/gid, shell...

6.1AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/14 5:54 p.m.27 views

Malicious code in chain-sdk-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb94ce743d92fe81015db70380ba325e78e4271b78689a9a6998cda4e6bdc038 chain-sdk-js is a typosquat of @thetalabs/theta-js package name, description, author 'Theta Labs', and bundle filenames thetajs.cjs.js/thetajs.umd.js...

6.2AI score
SaveExploits0References6
OSV
OSV
added 2026/07/14 5:53 p.m.8 views

MAL-2026-10607 Malicious code in chai-as-act (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbf85a5e85f183a28cc32ff39ddcc68ef15b698cc62eccfaa89dd1bb80c709f6 The package masquerades as a chai plugin but ships the pino logger source tree plus an additional payload file lib/initializeCaller.js. That file is ...

6.2AI score
SaveExploits0References1
NVD
NVD
added 2026/07/14 4:16 p.m.10 views

CVE-2026-11403

A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm NuGet API Key, Docker Bearer Token, or npm Bearer Token must be enabled an...

8.7CVSS0.00349EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/14 3:17 p.m.11 views

CVE-2026-58478

Sustainable Irrigation Platform SIP through version 5.2.16 contains a server-side request forgery SSRF vulnerability that allows unauthenticated attackers to make the device issue arbitrary HTTP requests by supplying a malicious callback URL when the optional Node-RED plugin is installed. Attacke...

6.5CVSS0.00261EPSS
SaveExploits2References2
Cvelist
Cvelist
added 2026/07/14 3:15 p.m.35 views

CVE-2026-15697 svgdotjs svg.js npm Package API EventTarget.on prototype pollution

A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated...

6.5CVSS0.0033EPSS
SaveExploits0References6
CVE
CVE
added 2026/07/14 2:41 p.m.27 views

CVE-2026-58478

SIP 5.2.16 has a server-side request forgery (SSRF) vulnerability when the optional Node-RED plugin is installed. An unauthenticated attacker can supply a malicious callback URL and cause the device to issue arbitrary HTTP requests due to lack of destination validation, aided by the default passp...

6.5CVSS6.2AI score0.00261EPSS
SaveExploits2References2Affected Software1
Cvelist
Cvelist
added 2026/07/14 2:41 p.m.37 views

CVE-2026-58478 Sustainable Irrigation Platform 5.2.16 SSRF via Node-RED Callback URL

Sustainable Irrigation Platform SIP through version 5.2.16 contains a server-side request forgery SSRF vulnerability that allows unauthenticated attackers to make the device issue arbitrary HTTP requests by supplying a malicious callback URL when the optional Node-RED plugin is installed. Attacke...

6.5CVSS0.00261EPSS
SaveExploits2References2
Chainguard
Chainguard
added 2026/07/14 2:17 p.m.27 views

CVE-2026-59875 vulnerabilities

Vulnerabilities for packages: code-server, sqlpad, prism, wazuh-dashboard-fips, kibana, lerna, gitlab-rails-ce-fips, opensearch-dashboards-fips, wazuh-dashboard, pulumi, gitlab-rails-ce, npm, kubeflow-centraldashboard, graalvm, saf, opensearch-dashboards, actions-runner...

5.3CVSS5.1AI score0.00292EPSS
SaveExploits0
Chainguard
Chainguard
added 2026/07/14 2:17 p.m.29 views

CVE-2026-59874 vulnerabilities

Vulnerabilities for packages: code-server, sqlpad, homepage, prism, kibana, lerna, gitlab-rails-ce-fips, opensearch-dashboards-fips, wazuh-dashboard, pulumi, wazuh-dashboard-fips, gitlab-rails-ce, npm, kubeflow-centraldashboard, graalvm, saf, opensearch-dashboards, actions-runner...

8.7CVSS7.2AI score0.00418EPSS
SaveExploits1
Chainguard
Chainguard
added 2026/07/14 2:17 p.m.30 views

CVE-2026-59873 vulnerabilities

Vulnerabilities for packages: code-server, sqlpad, homepage, prism, kibana, lerna, gitlab-rails-ce-fips, opensearch-dashboards-fips, wazuh-dashboard, pulumi, wazuh-dashboard-fips, gitlab-rails-ce, npm, kubeflow-centraldashboard, graalvm, saf, opensearch-dashboards, actions-runner...

9.2CVSS7.4AI score0.00424EPSS
SaveExploits1
Wolfi
Wolfi
added 2026/07/14 2:16 p.m.24 views

CVE-2026-59875 vulnerabilities

Vulnerabilities for packages: saf, pulumi, lerna, prism, npm, code-server, sqlpad, kubeflow-centraldashboard...

5.3CVSS5.1AI score0.00292EPSS
SaveExploits0
Wolfi
Wolfi
added 2026/07/14 2:16 p.m.24 views

CVE-2026-59871 vulnerabilities

Vulnerabilities for packages: saf, pulumi, lerna, prism, npm, code-server, sqlpad, kubeflow-centraldashboard...

7.5CVSS5.1AI score0.0041EPSS
SaveExploits1
OSV
OSV
added 2026/07/14 2:1 p.m.10 views

MAL-2026-10589 Malicious code in nodeaxois (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebf1f3f7342689c11ad7e8c17a1c584fe3ce15615db82868b289d9613b48a41a The package declares scripts.postinstall: node.init.js, which runs automatically on npm install. The.init.js script collects host metadata os.hostnam...

6.1AI score
SaveExploits0References1
OSV
OSV
added 2026/07/14 2:0 p.m.11 views

MAL-2026-10583 Malicious code in chalkdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31c82b41c09114082b8c0ac8ba6f7bf5ffad8b7da40478ce409443ef00171619 chalkdev is a near-empty package index.js exports , 11-byte README whose sole runtime behavior is a postinstall hook that runs .init.js on npm instal...

6.1AI score
SaveExploits0References1
OSV
OSV
added 2026/07/14 1:59 p.m.6 views

MAL-2026-10590 Malicious code in openaiwrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea3d691208e7e5c443aa161241ca12c9b3eacb1b04428f886ea8c5fbec5a4d0c The package's postinstall lifecycle hook runs.init.js, which reads a hardcoded list of credential-shaped environment variables including NPMTOKEN,...

6.1AI score
SaveExploits0References1
OSV
OSV
added 2026/07/14 12:58 p.m.7 views

MAL-2026-10579 Malicious code in bimi-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a4e6202887cfa87e6dcff6e37af854445a0e44f38b25ef6d3e40fec06cc8b5f On npm install, the package's preinstall hook runs node index.js, which executes whoami and id via childprocess and collects os.hostname, os.userInfo...

6.1AI score
SaveExploits0References1
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/14 12:55 p.m.7 views

Security Bulletin: Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Data Synchronization App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-23950 DESCRIPTION: node-tar,a...

8.8CVSS6.8AI score0.08279EPSS
SaveExploits2Affected Software1
Rows per page
Query Builder