262027 matches found
MAL-2026-11102 Malicious code in riskunifiedgatewayserv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d96d72f82bb3dfb9c04ca9b519f859677fd07d6396699d9273ef5ef14547d2b Package installs a preinstall hook that runs index.js on npm install. The script collects the installer's hostname, platform, architecture, home...
Malicious Package
Overview stargateproxyserv is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview f0-fpti-tracking-manager is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
CVE-2026-66396
SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary...
GO-2026-6082 Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint in gitea.dev
Gitea: Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint in gitea.dev...
CVE-2026-17514
A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The...
MAL-2026-11095 Malicious code in @array-util/subsearch (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 793344e3c658f3649a113e29dd1124d979af9a7978f3159c55f8da6f6b3bc918 The package's index.js is heavily obfuscated string-array shift/rotate pattern with hex-encoded indices and a while!! decoder loop. Obfuscation in a...
CVE-2026-17514 ZJONSSON node-unzipper extract.js Extract path traversal
A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The...
EUVD-2026-49201
A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The...
CVE-2026-17514
A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The...
CVE-2026-17514
Technical details are not publicly available in the provided documents. Monitor for updates.
CVE-2026-17514
A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The...
CVE-2026-17514 ZJONSSON node-unzipper extract.js Extract path traversal
A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The...
CVE-2026-17514 ZJONSSON node-unzipper extract.js Extract path traversal
A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The...
MAL-2026-11104 Malicious code in tailwind-motionkit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84dfdf101e36c7ca60ca1a1e72d59a7893a5abee9bf359852cdeabdb0af2cd2 Review of [email protected] surfaced no evidence of exfiltration, install-time remote code execution, silent relay, credential distribution,...
DEBIAN-CVE-2026-55968
Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...
ROOT-APP-NPM-GHSA-9GGV-8W38-R7PM GHSA-9ggv-8w38-r7pm in @rootio/typeorm - Patched by Root
Root has patched GHSA-9ggv-8w38-r7pm in the @rootio/typeorm package for Root:npm. Multiple fixed versions available...
CVE-2026-55968 Apache Thrift: Node.js quadratic-time DoS in server receive transports
Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...
CVE-2026-55968 Apache Thrift: Node.js quadratic-time DoS in server receive transports
Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...
CVE-2026-55968
Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...