GHSA-RVX4-FFVW-M9Q3 Composer arbitrary command execution via a malicious package's Perforce source URL

Summary If the p4 Perforce CLI client is installed, a malicious dependency package from a package repository allowing arbitrary perforce source URLs packagist.org is safe could execute arbitrary commands when running composer install or composer update. Composer passed a package's Perforce source...

CVE-2026-82710

usage_rules (ash-project, Elixir Mix task) is vulnerable to terminal escape sequence injection via the Mix.Tasks.UsageRules.SearchDocs formatter. Publisher-controlled fields from Hex documentation are interpolated verbatim without neutralizing terminal control characters, allowing a malicious pac...

CVE-2026-82584 Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's hex...

EEF-CVE-2026-82584 Terminal escape sequence injection in the mix igniter.install confirmation prompt via package metadata

Summary Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igniter.install prints a confirmation panel an anti-typosquatting safeguard listing a package's...

CVE-2026-82584

ash-project igniter (an Elixir build tool) is vulnerable to terminal escape sequence injection in its mix igniter.install confirmation panel. The panel builder in Igniter.Project.Deps wrote publisher-controlled fields (meta.description, owner usernames, requirement names, version) to the terminal...

CVE-2026-70550

An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory version...

EUVD-2026-65546

An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadata from repositories they are not authorized to read. The issue affects confidentiality and has been addressed in fixed Artifactory version...

CVE-2026-70547

An authenticated user without repository read permission may access package metadata under specific conditions...

EUVD-2026-57260

An authenticated user without repository read permission may access package metadata under specific conditions...

CVE-2026-70547

An authenticated user without repository read permission may access package metadata under specific conditions...

PT-2026-71135

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user who lacks repository read permissions may be able to access package metadata under specific conditions. Recommendations At the moment, ther...

Malicious code in wolverinechat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ad1c6bad5ee8d3cb562503b94d5534ba2c98ad5b4854c073e1482d59ab8687e package.json declares a preinstall hook that runs index.js during npm install. The script reads /etc/passwd, /etc/hosts, os.hostname,...

Malicious code in mcp-audit-sync-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897822fdfb08c83d7d949c16e497d6897b9b679cc2f05a0409b1ec369a1f10fc [email protected] declares scripts.preinstall = 'node index.js'. On Windows, index.js spawns a hidden PowerShell process that fetches a...

Linux Distros Unpatched Vulnerability : CVE-2026-67338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata...

UBUNTU-CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338 JupyterLab before 4.5.9 Stored XSS via Extension Manager

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338

CVE-2026-67338 affects JupyterLab prior to 4.5.9. A stored cross-site scripting vulnerability resides in the Extension Manager where URI protocols in package metadata URLs are not validated. This allows an attacker to publish malicious PyPI packages with javascript: URLs in project metadata, enab...

PT-2026-57043

Name of the Vulnerable Software and Affected Versions rattler cache affected versions not specified py-rattler affected versions not specified Description These components are susceptible to package-cache path traversal when processing package metadata from conda channels. During cache...

BIT-GITLAB-2026-5796 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with Reporter-level group permissions to view package metadata from projects with the...