@activepieces/piece-json (>=0.1.6, <=0.1.7), @bifravst/muninn-proto (>=5.0.0, <=5.2.0) +109 more potentially affected by CVE-2026-77415 via jsonata (>=2.0.0, <=2.1.0)

jsonata NPM version =2.0.0, =0.1.6, =5.0.0, =2.3.132, =37.301.2, =1.0.4, =11.8.0, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =3.3.0 and more Source cves: CVE-2026-77415 Source advisory: SNYK:JS-JSONATA-19233334...

@activepieces/piece-json (>=0.1.6, <=0.1.7), @bifravst/muninn-proto (>=5.0.0, <=5.2.0) +109 more potentially affected by CVE-2026-77415 via jsonata (>=2.0.0, <=2.1.0)

jsonata NPM version =2.0.0, =0.1.6, =5.0.0, =2.3.132, =37.301.2, =1.0.4, =11.8.0, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =3.3.0 and more Source cves: CVE-2026-77415 Source advisory: OSV:GHSA-66MM-25PP-RFFF...

NPM: JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

NPM: JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions vulnerability discovered by ? in WordPress Npm jsonata versions 1.8.8...

Prototype Pollution

Overview jsonata is a JSON query and transformation language Affected versions of this package are vulnerable to Prototype Pollution via unsafe object creation patterns throughout the codebase src/jsonata.js, src/functions.js, src/parser.js, src/signature.js, and src/datetime.js. An attacker who...

NPM: JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

NPM: JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions vulnerability discovered by ? in WordPress Npm jsonata versions 1.8.8...

@3c-node-red/runtime (3.1.6), @adeunis/node-red-contrib-adeunis-codecs (1.0.0) +342 more potentially affected by CVE-2026-77414 via jsonata (>=1.0.10, <=1.8.7)

jsonata NPM version =1.0.10, =0.0.1, =0.0.1, =0.0.1, =0.17.5, =20.2.3, =5.0.0-aws-sdk-v3.2, =0.0.1, =0.8.0, =0.0.1, =0.0.114 and more Source cves: CVE-2026-77414 Source advisory: SNYK:JS-JSONATA-19233336...

@activepieces/piece-json (>=0.1.6, <=0.1.7), @bifravst/muninn-proto (>=5.0.0, <=5.2.0) +109 more potentially affected by CVE-2026-77414 via jsonata (>=2.0.0, <=2.1.0)

jsonata NPM version =2.0.0, =0.1.6, =5.0.0, =2.3.132, =37.301.2, =1.0.4, =11.8.0, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =3.3.0 and more Source cves: CVE-2026-77414 Source advisory: OSV:GHSA-2943-5XFG-GQ5F...

@3c-node-red/runtime (3.1.6), @adeunis/node-red-contrib-adeunis-codecs (1.0.0) +342 more potentially affected by CVE-2026-77414 via jsonata (>=1.0.10, <=1.8.7)

jsonata NPM version =1.0.10, =0.0.1, =0.0.1, =0.0.1, =0.17.5, =20.2.3, =5.0.0-aws-sdk-v3.2, =0.0.1, =0.8.0, =0.0.1, =0.0.114 and more Source cves: CVE-2026-77414 Source advisory: OSV:GHSA-2943-5XFG-GQ5F...

@activepieces/piece-json (>=0.1.6, <=0.1.7), @bifravst/muninn-proto (>=5.0.0, <=5.2.0) +109 more potentially affected by CVE-2026-77414 via jsonata (>=2.0.0, <=2.1.0)

jsonata NPM version =2.0.0, =0.1.6, =5.0.0, =2.3.132, =37.301.2, =1.0.4, =11.8.0, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =3.3.0 and more Source cves: CVE-2026-77414 Source advisory: SNYK:JS-JSONATA-19233336...

@3c-node-red/runtime (3.1.6), @adeunis/node-red-contrib-adeunis-codecs (1.0.0) +342 more potentially affected by CVE-2026-77413 via jsonata (>=1.0.10, <=1.8.7)

jsonata NPM version =1.0.10, =0.0.1, =0.0.1, =0.0.1, =0.17.5, =20.2.3, =5.0.0-aws-sdk-v3.2, =0.0.1, =0.8.0, =0.0.1, =0.0.114 and more Source cves: CVE-2026-77413 Source advisory: OSV:GHSA-8GQ3-VP5J-2GRP...

NPM: JSONata: Arbitrary Code Execution via crafted JSONata expressions

NPM: JSONata: Arbitrary Code Execution via crafted JSONata expressions vulnerability discovered by ? in WordPress Npm jsonata versions = 1.8.7...

@3c-node-red/runtime (3.1.6), @adeunis/node-red-contrib-adeunis-codecs (1.0.0) +342 more potentially affected by CVE-2026-77413 via jsonata (>=1.0.10, <=1.8.7)

jsonata NPM version =1.0.10, =0.0.1, =0.0.1, =0.0.1, =0.17.5, =20.2.3, =5.0.0-aws-sdk-v3.2, =0.0.1, =0.8.0, =0.0.1, =0.0.114 and more Source cves: CVE-2026-77413 Source advisory: SNYK:JS-JSONATA-19233338...

@activepieces/piece-json (>=0.1.6, <=0.1.7), @bifravst/muninn-proto (>=5.0.0, <=5.2.0) +109 more potentially affected by CVE-2026-77413 via jsonata (>=2.0.0, <=2.1.0)

jsonata NPM version =2.0.0, =0.1.6, =5.0.0, =2.3.132, =37.301.2, =1.0.4, =11.8.0, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =3.3.0 and more Source cves: CVE-2026-77413 Source advisory: SNYK:JS-JSONATA-19233338...

@activepieces/piece-json (>=0.1.6, <=0.1.7), @bifravst/muninn-proto (>=5.0.0, <=5.2.0) +109 more potentially affected by CVE-2026-77413 via jsonata (>=2.0.0, <=2.1.0)

jsonata NPM version =2.0.0, =0.1.6, =5.0.0, =2.3.132, =37.301.2, =1.0.4, =11.8.0, =1.0.0, =0.0.2, =1.0.0, =1.0.0, =3.3.0 and more Source cves: CVE-2026-77413 Source advisory: OSV:GHSA-8GQ3-VP5J-2GRP...

@kids-reporter/cms-core (>=1.0.17, <=1.0.36), @kids-reporter/draft-editor (>=1.0.19, <=1.0.36) potentially affected by CVE-2026-63421 via @keystone-6/core (6.5.1)

@keystone-6/core NPM version 6.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on @keystone-6/core and may be impacted: - @kids-reporter/cms-core =1.0.17, =1.0.19, =1.0.36 Source cves: CVE-2026-63421 Source advisory: OSV:GHSA-CQMQ-8755-7XVH...

NPM: Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors

NPM: Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors vulnerability discovered by ? in WordPress Npm defuddle versions = 0.19.0...

@agent-infra/browser-context (>=0.1.2, <=0.2.2), @agent-infra/mcp-server-browser (>=1.2.15, <=1.2.29) +115 more potentially affected by CVE-2026-61824 via defuddle (>=0.3.8, <=0.18.1)

defuddle NPM version =0.3.8, =0.1.2, =1.2.15, =0.1.2, =2.4.0, =0.1.0, =0.0.1777999615-g5ad1bf1, =0.8.0, =26.7.0, =0.3.1-alpha.1, =2.6.0, =1.0.0, =1.0.2, =0.0.1, =0.0.2 and more Source cves: CVE-2026-61824 Source advisory: OSV:GHSA-JG4P-G6XJ-4QMF...

NPM: Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username

NPM: Unleash: Global Mustache.escape override disables HTML escaping process-wide, enabling Slack/Teams link-injection via unrestricted username vulnerability discovered by ? in WordPress Npm unleash-server versions 8.0.3...

NPM: Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers

NPM: Unleash: Addon webhook URL is dialed server-side with no internal-address filtering, enabling SSRF to internal services / cloud metadata and exfiltration of configured request headers vulnerability discovered by ? in WordPress Npm unleash-server versions 7.5.2...

14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2

Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence AI-powered Linux implant dubbed RedC2 4.0. "When the module loads, it locates the bundled binary,...