255614 matches found
CVE-2026-45617
LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the built-in striphtml filter uses a regex containing four flawed lazy-quantified alternatives, leading to ReDoS via quadratic backtracking. When the input contains many script...
Malicious code in uol-simple-api-futebol (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 962c38ed6ec061ce6a530aeea5a960dfc2b75caec56f7a1bc648f6b6cb655271 The package's only documented function, getJogos default export, unconditionally invokes an internal helper named prepareCacheMatchs which POSTs the...
CVE-2026-54533 vantage6 node has an Improper Access Control issue
vantage6 is an open-source infrastructure for privacy preserving analysis. Prior to version 5.0.0, malicious algorithms can potentially access other algorithms input and output files. Version 5.0.0 fixes the issue. As a workaround, verify and restrict the algorithm containers that are allowed to...
MAL-2026-6085 Malicious code in @hotcappuccino/nodepull (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 42e9bbd7a5cb25d0863ef140b42a7ab2abec1e921e18669eef3f07a91c3d6d99 @hotcappuccino/[email protected] ships a single index.js the package's declared main that is wrapped in an obfuscator.io string-array +...
Malicious code in set-proto-chain (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdb11eef3afbfc268bd48a18737884246861c7ae9e6a3d29901ae1379216c633 lib/index.js contains a base64-encoded URL decoding to https://jsonkeeper.com/b/BN77K, an anonymous mutable paste host that is fetched via axios.get;...
MAL-2026-6074 Malicious code in @mastra/redis (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9691125da52a04efba450b4c5dcbebe08a604a54f2e9420d95ce17f782f2728 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
@0xwork/connect (>=0.1.0 <=0.1.9), @1001-digital/components.evm (>=1.3.0 <=3.6.11) +1373 more potentially affected by CVE-2026-6733 via undici (>=8.0.0 <=8.4.1)
undici NPM version =8.0.0, =0.1.0, =1.3.0, =0.1.0, =1.2.2, =0.3.0, =0.3.0, =0.3.1, =5.0.1-staging.3edc9d7b8d6f, =5.0.1-staging.3edc9d7b8d6f, =5.1.1-staging.0ad6ac75ae4a, =5.1.1-staging.0ad6ac75ae4a, =5.0.1-staging.4b92bc7a3e3b, =5.0.1-staging.3abdf9534c25, =2026.6.2, =2026.6.5 and more Source cve...
MAL-2026-6071 Malicious code in n8n-nodes-security-test-poc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa97d4701c29ef5305fa5b553ab560abd6db6cc33b72f99dc11621997b668f32 Package presents as an n8n community node but is an attack artifact. The node's execute in dist/SecurityTestNode.node.js queries AWS IMDSv1/v2...
CVE-2026-20181
A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to...
CVE-2026-20181
Cisco ISE/ISE-PIC in Cisco IOS XE is affected by CVE-2026-20181. The CVE entry describes authenticated remote command execution via crafted HTTP input with privilege escalation to root and potential DoS in single-node deployments. Connected PT-security material (PT-2026-34270) references a separa...
ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`
A flaw was found in ws, an open source WebSocket client and server for Node.js. The websocket.close implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This can lead to the disclosure of sensitive information from uninitialized memor...
NPM: NocoDB: Refresh Tokens Persist Through Password Recovery
NPM: NocoDB: Refresh Tokens Persist Through Password Recovery vulnerability discovered by ? in WordPress Npm nocodb versions = 0.301.3...
Creation of Temporary File in Directory with Insecure Permissions
Overview @mariozechner/pi-coding-agent is a Coding agent CLI with read, bash, edit, write tools and session management Affected versions of this package are vulnerable to Creation of Temporary File in Directory with Insecure Permissions in the process handling temporary extension package installs...
CVE-2026-48779
ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to but not including 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally...
UBUNTU-CVE-2026-48779
ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to but not including 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally...
MAL-2026-6063 Malicious code in sort-btree (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c21e3fbfbd2c75d226e7f427d760d771d29d6f612eaaa98b5b6daed7bc164035 Pattern matches fired on minified files extended/b+tree.min.js and extended/bulkLoad.min.d.js based on keyword co-occurrence require"childprocess",...
MAL-2026-6061 Malicious code in qrcode-generator-node (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2e3780245e75cd7c6d52efe4281c744dcfd740224d1d53a22228fb702a193e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-6060 Malicious code in qrcode-express (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b22e1bf641d5ee5ced5547dd7cdd0f0e6a3525bf029dc3f276e85bb3a013019 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-6064 Malicious code in tailwindcss-animates-css (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7250854be2f2ab8b43e62611a704a3c31d3f42180356e61955b4fc30fd2bcf4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...