@agiflowai/aicode-toolkit (>=1.2.0, <=1.3.0), @agiflowai/one-mcp (>=0.4.1, <=0.4.2) +30 more potentially affected by CVE-2026-61556 via liquidjs (>=10.26.0, <=10.27.0)

liquidjs NPM version =10.26.0, =1.2.0, =0.4.1, =1.2.0, =1.1.0, =2.0.0-rc.0, =2.0.0-rc.0, =2.0.0-rc.0, =36.0.0-rc.0, =0.0.1-beta.0, =3.0.0, =0.5.0, =0.3024.0, =0.3024.0, =1.1.1 and more Source cves: CVE-2026-61556 Source advisory: SNYK:JS-LIQUIDJS-19006352...

CVE-2026-59992

creationtimestamp| type| source ---|---|--- 2026-08-19 22:35:05+00:00| published-proof-of-concept| https://github.com/tinacms/tinacms/security/advisories/GHSA-8mq9-5fw2-5rm4...

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in next-tinacms-s3 and sibling production media adapters vulnerability discovered by ? in WordPress Npm next-tinacms-s3 versions 23.0.4...

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)

NPM: Tina: Broken Access Control: arbitrary bucket-key write/delete in next-tinacms-s3 and sibling production media adapters vulnerability discovered by ? in WordPress Npm next-tinacms-dos versions 23.0.4...

CVE-2026-63188

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through...

CVE-2026-63188 logto-tunnel serves files outside --experience-path via path traversal

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through...

NPM: SearXNG MCP Server: Additional hardened-mode SSRF bypasses

NPM: SearXNG MCP Server: Additional hardened-mode SSRF bypasses vulnerability discovered by ? in WordPress Npm mcp-searxng versions 1.2.1...

NPM: SearXNG MCP Server is Vulnerable to SSRF in web_url_read: the internal-address guard is disabled by default (MCP_HTTP_HARDEN off)

NPM: SearXNG MCP Server is Vulnerable to SSRF in weburlread: the internal-address guard is disabled by default MCPHTTPHARDEN off vulnerability discovered by ? in WordPress Npm mcp-searxng versions 1.2.1...

@contentful/mcp-server (>=1.7.0-dev-20251016T1739-07b05ef.0, <=1.7.18), @iflow-mcp/contentful-contentful-mcp-server (>=1.7.7, <=1.7.8) potentially affected by CVE-2026-53957 via @contentful/mcp-tools (>=0.1.0, <=0.4.4)

@contentful/mcp-tools NPM version =0.1.0, =1.7.0-dev-20251016T1739-07b05ef.0, =1.7.7, =1.7.8 Source cves: CVE-2026-53957 Source advisory: OSV:GHSA-2XHG-73J7-RRGX...

MAL-2026-14305 Malicious code in mc-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e494af2871662b1b342a26141de010623484dfef353b505805f4b41d85d775c1 Package metadata describes mc-provider as 'Theta chain registry ⚛️' and the README is a verbatim copy of the hyperweb-io/chain-registry README...

Malicious code in mc-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e494af2871662b1b342a26141de010623484dfef353b505805f4b41d85d775c1 Package metadata describes mc-provider as 'Theta chain registry ⚛️' and the README is a verbatim copy of the hyperweb-io/chain-registry README...

MAL-2026-14303 Malicious code in x6842179305 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca4cf1d317cc7c96f8007c983999e18529f2cb8dea5514dcc68f704c7bda5638 Package x6842179305 ships a main entry 1.js that invokes the Function constructor over a custom-encoded, keyed/XOR-decoded byte buffer, causing an...

Malicious code in ai-texts-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a340348046b89bf8c446a31a4f48233ec4e0bc412f531db713f54f35c6ea922c [email protected] declares a single runtime dependency, 'ai-texts', shipped as a bundledDependency inside the tarball. That bundled module present...

MAL-2026-14302 Malicious code in ai-texts-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a340348046b89bf8c446a31a4f48233ec4e0bc412f531db713f54f35c6ea922c [email protected] declares a single runtime dependency, 'ai-texts', shipped as a bundledDependency inside the tarball. That bundled module present...

Malicious code in node-runtime-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cac7a39a8896a7f78a20fe79758f146d2158f2fc529e51ac705720a745552770 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in bunnyhijack-test-0x00 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 652b21307c316c7a3237991fdfb6dc4d43716997a91268f43fe9c9c65a3fd76e package.json declares "bin": "node": "./shim.js" , which causes npm to place a node executable into nodemodules/.bin. Since nodemodules/.bin is...

CVE-2026-76230

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...

CVE-2026-76230

Renovate (renovatebot/renovate) versions 35.63.0 through 40.32.x contain a command injection vulnerability in the npm manager . The root cause is that user-provided packageName values are appended to npm install commands in lib/modules/manager/npm/post-update/npm.ts without being escaped via the ...

CVE-2026-76230 Renovate 35.63.0 before 40.33.0 Command Injection via npm

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...

EUVD-2026-62471

Renovate versions from 35.63.0 before 40.33.0 contain a command injection vulnerability in the npm manager where user-provided packageName values are appended to npm install commands without proper sanitization. Attackers with repository write access can craft malicious Renovate configuration fil...