CVE-2026-68499

creationtimestamp| type| source ---|---|--- 2026-07-31 18:35:14+00:00| published-proof-of-concept| https://github.com/uhop/node-re2/security/advisories/GHSA-6hxr-mr5r-9836...

CVE-2026-67550

creationtimestamp| type| source ---|---|--- 2026-07-31 18:35:12+00:00| published-proof-of-concept| https://github.com/uhop/node-re2/security/advisories/GHSA-ff84-5f28-78qj...

MAL-2026-11461 Malicious code in eth-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d7fbf15a08eb3568d462e06fa345cfdb59afe88bf38b63e47ecea29ea92c009 The package presents itself as an Ethereum bridge library but its index.js is a verbatim copy of the well-known eth-sig-util signature utility...

NPM: hashi-vault-js has a path traversal and query parameter injection

NPM: hashi-vault-js has a path traversal and query parameter injection vulnerability discovered by ? in WordPress Npm hashi-vault-js versions = 0.5.1...

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Summary CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and ForbiddenAnnotations.Regex are never validated by any admission webhook. A Cluster Admin can persist a malformed regex to etcd without being blocked. Once stored, every Node CREATE, UPDATE, or PATCH request triggers...

GHSA-68CJ-MVG9-RGM2 Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests

Summary CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and ForbiddenAnnotations.Regex are never validated by any admission webhook. A Cluster Admin can persist a malformed regex to etcd without being blocked. Once stored, every Node CREATE, UPDATE, or PATCH request triggers...

EUVD-2026-51295

Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests...

EUVD-2026-51297

re2: Out-of-bounds heap read in exec/test/match via attacker-influenced lastIndex on a non-ASCII subject → uncatchable process crash DoS...

NPM: re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

NPM: re2: Global String.prototype.match with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth DoS vulnerability discovered by ? in WordPress Npm re2 versions = 1.25.1...

GHSA-PFVC-3P5H-X7H6 Wings exposes node configuration secrets through egg configuration-file templating

Impact Type: Exposure of sensitive information / insufficiently protected credentials leading to privilege escalation and full node compromise. Wings exposes its entire daemon configuration to the egg configuration-file templating engine. When Wings renders a server's configuration files, any...

Wings exposes node configuration secrets through egg configuration-file templating

Impact Type: Exposure of sensitive information / insufficiently protected credentials leading to privilege escalation and full node compromise. Wings exposes its entire daemon configuration to the egg configuration-file templating engine. When Wings renders a server's configuration files, any...

CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

EUVD-2026-51568

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

Malicious Package

Overview @0xlr/question-types is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in @0xlr/question-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69f892cd190720c7c8f07109cfcbdd37f66caf5065ba5667b5be0800813dc0cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @0xlr/supabase-db is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @0xlr/test-callback is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-11433 Malicious code in @0xlr/test-callback (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09f54fc6282ea45cdd155c621f41ce7bb3d8f5622ba8eef14cec7e97397b3efa @0xlr/[email protected] is a minimal package with no observed installer-harm behavior. No lifecycle scripts performing network fetches or shell...

CVE-2026-18446

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...