MAL-2026-6287 Malicious code in poly-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5aab464aac47233efb564c52d5818fef783efa856f8318c61d61ef99ca0da4e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-56301 Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux

Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server nuxt dev on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit t...

EUVD-2026-38436

Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server nuxt dev on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit t...

CVE-2026-56301 Nuxt - Arbitrary File Read via World-Connectable vite-node IPC Socket on Linux

Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7, when running the development server nuxt dev on Linux, binds the vite-node IPC server to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivileged co-resident users can exploit t...

CVE-2026-56301

Nuxt CVE-2026-56301 affects Nuxt 4.0.0 before 4.4.7 and 3.18.0 before 3.21.7. When running the development server (nuxt dev) on Linux, the vite-node IPC server is bound to an abstract-namespace Unix socket without permission restrictions, allowing local users to enumerate and connect. Unprivilege...

CVE-2026-56275 Flowise - Server-Side Request Forgery via Execute Flow Base URL

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...

CVE-2026-56275

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...

EUVD-2026-38435

Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node that allows attackers to bypass security validation by providing intranet addresses through the base URL field. Attackers can initiate HTTP requests to internal network addresses, access cloud...

Malicious code in libsignal-node-travatiger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 311b53330c1d8c3546d0b4fa3d460ca694fc20d60608ac5a276f40f7a73279fa On require of this package, index.js schedules install.js which locates @whiskeysockets/baileys in the installer's nodemodules tree searching...

CVE-2026-41178 vulnerabilities

Vulnerabilities for packages: crossplane-provider-sql-fips, kcp-fips, openbao, crossplane-provider-azure-authorization, hubble-ui, node-feature-discovery-fips, flux, agentbeat-fips, crossplane-provider-azure-synapse, kube-vip-cloud-provider, grafana-pyroscope, kube-rbac-proxy,...

GHSA-5WRP-CWCJ-Q835 vulnerabilities

Vulnerabilities for packages: crossplane-provider-sql-fips, kcp-fips, openbao, crossplane-provider-azure-authorization, hubble-ui, node-feature-discovery-fips, flux, agentbeat-fips, crossplane-provider-azure-synapse, kube-vip-cloud-provider, grafana-pyroscope, kube-rbac-proxy,...

CVE-2026-12151 vulnerabilities

Vulnerabilities for packages: renovate, node-gyp, haraka, vitess, prism, code-server, pelias-api, py3-captum, actions-runner, gemini-cli, saf, kibana, npm...

GHSA-G8M3-5G58-FQ7M vulnerabilities

Vulnerabilities for packages: renovate, node-gyp, haraka, vitess, prism, code-server, pelias-api, py3-captum, actions-runner, gemini-cli, saf, kibana, npm...

GHSA-P88M-4JFJ-68FV vulnerabilities

Vulnerabilities for packages: renovate, node-gyp, haraka, vitess, prism, code-server, pelias-api, py3-captum, actions-runner, gemini-cli, saf, kibana, npm...

GHSA-35P6-XMWP-9G52 vulnerabilities

Vulnerabilities for packages: renovate, node-gyp, haraka, vitess, prism, code-server, pelias-api, py3-captum, actions-runner, gemini-cli, saf, kibana, npm...

CVE-2026-6733 vulnerabilities

Vulnerabilities for packages: renovate, node-gyp, haraka, vitess, prism, code-server, pelias-api, py3-captum, actions-runner, gemini-cli, saf, kibana, npm...

CVE-2026-9679 vulnerabilities

Vulnerabilities for packages: renovate, node-gyp, haraka, vitess, prism, code-server, pelias-api, py3-captum, actions-runner, gemini-cli, saf, kibana, npm...

CVE-2026-11525 vulnerabilities

Vulnerabilities for packages: renovate, node-gyp, haraka, vitess, prism, code-server, pelias-api, py3-captum, actions-runner, gemini-cli, saf, kibana, npm...

CVE-2026-49261

A flaw was found in MariaDB server. When the wsrepnotifycmd feature is enabled, a remote attacker could exploit this vulnerability by embedding shell commands in the name of a joiner node. This could lead to arbitrary code execution on the server, allowing the attacker to take full control of the...

MAL-2026-6278 Malicious code in ts-wross (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42dae43b7ff77748f10ae5faf6d87b7d63552e5629a37c931ea2c0de3539b469 Package is published under the name ts-wross but its package.json claims authorship by Michael Mclaughlin [email protected] and points its repository...