CVE-2026-59141

Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdxfindlocked. The attach-time validator rdxvalidateheader checks the header scalars and region layout against the file size, but does not validate the node records it then...

GHSA-VCRF-J523-4MRF aws-cdk-lib: OS Command Injection in NodejsFunction Docker Bundling

Summary AWS CDK aws-cdk-lib is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS command injection issue in the NodejsFunction Docker bundling pipeline in aws-cdk-lib before 2.260.0 that might allow an actor who controls dependen...

CVE-2026-59141

Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdxfindlocked. The attach-time validator rdxvalidateheader checks the header scalars and region layout against the file size, but does not validate the node records it then...

CVE-2026-59141 Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdx_find_locked

Data::RadixTree::Shared versions before 0.02 for Perl allow an out-of-bounds read via unvalidated node and arena indices in rdxfindlocked. The attach-time validator rdxvalidateheader checks the header scalars and region layout against the file size, but does not validate the node records it then...

CVE-2026-59140

CVE-2026-59140 affects Data::SortedSet::Shared

CVE-2026-59140

Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths. The attach-time validator ssvalidateheader bounds only the root index against the node pool nodecapacity. The order-statistics and min/max queries th...

EUVD-2026-42315

Immutabl: Hash-collision algorithmic complexity denial of service in Immutable.Map/Set...

GHSA-FRVP-7C67-39W9 Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`)

The same as the hono core Path traversal in serve-static on Windows via encoded backslash %5C. Summary On Windows hosts, an encoded backslash %5C in the request path decodes to , which the Windows path resolver treats as a separator. serve-static then resolves a single URL segment such as...

MAL-2026-10984 Malicious code in veskra (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4618cc8c89ff606f81079aef2e98920220ca9e59ec284c8d6c18167208604a3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10980 Malicious code in nolby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...

OPENSUSE-SU-2026:21399-1 Security update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions

This update for cockpit, cockpit-machines, cockpit-packages, cockpit-podman, cockpit-repos, cockpit-subscriptions fixes the following issues: Security issues fixed: - CVE-2025-13465: lodash: prototype pollution in the .unset and .omit functions can lead to deletion of methods from global prototyp...

GHSA-W8WR-V893-VJVP vulnerabilities

Vulnerabilities for packages: code-server, graalvm, npm, gitlab-rails-ce-fips, kubeflow-centraldashboard, homepage, opensearch-dashboards-fips, sqlpad, actions-runner, kibana, opensearch-dashboards, saf, lerna, wazuh-dashboard, wazuh-dashboard-fips, prism, pulumi, gitlab-rails-ce...

GHSA-8X88-C5MF-7J5W vulnerabilities

Vulnerabilities for packages: code-server, graalvm, npm, gitlab-rails-ce-fips, kubeflow-centraldashboard, homepage, opensearch-dashboards-fips, sqlpad, actions-runner, kibana, opensearch-dashboards, saf, lerna, wazuh-dashboard, wazuh-dashboard-fips, prism, pulumi, gitlab-rails-ce...

GHSA-GVWX-54WH-QM9J vulnerabilities

Vulnerabilities for packages: code-server, graalvm, npm, gitlab-rails-ce-fips, kubeflow-centraldashboard, opensearch-dashboards-fips, sqlpad, actions-runner, kibana, opensearch-dashboards, saf, lerna, wazuh-dashboard, wazuh-dashboard-fips, prism, pulumi, gitlab-rails-ce...

GHSA-23HP-3JRH-7FPW vulnerabilities

Vulnerabilities for packages: code-server, graalvm, npm, gitlab-rails-ce-fips, kubeflow-centraldashboard, homepage, opensearch-dashboards-fips, sqlpad, actions-runner, kibana, opensearch-dashboards, saf, lerna, wazuh-dashboard, wazuh-dashboard-fips, prism, pulumi, gitlab-rails-ce...

GHSA-8X88-C5MF-7J5W vulnerabilities

Vulnerabilities for packages: saf, lerna, prism, sqlpad, code-server, pulumi, npm, kubeflow-centraldashboard...

GHSA-23HP-3JRH-7FPW vulnerabilities

Vulnerabilities for packages: saf, lerna, prism, sqlpad, code-server, pulumi, npm, kubeflow-centraldashboard...

GHSA-GVWX-54WH-QM9J vulnerabilities

Vulnerabilities for packages: saf, lerna, prism, sqlpad, code-server, pulumi, npm, kubeflow-centraldashboard...

GHSA-W8WR-V893-VJVP vulnerabilities

Vulnerabilities for packages: saf, lerna, prism, sqlpad, code-server, pulumi, npm, kubeflow-centraldashboard...

Malicious code in react-tabulix-virtual (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dbfc5a819e6dfbc3c65ec83a79a9f93a95da71259279c54e95f34c36ab81a22f The OpenSSF Package Analysis project identified 'react-tabulix-virtual' @ 0.1.1 npm as malicious. It is considered malicious because: - The...