MAL-2026-11510 Malicious code in beaver-ui-layout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 465b05640a3068a007c565655d946564a39211eeca92f8637b7c3b4fe9c9dece The package is advertised as a React UI layout library but on require'beaver-ui-layout' loads bridge.js, which reconstructs hostnames from array-join...

MAL-2026-11507 Malicious code in beaver-ui-grid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b077d7cccabfb111781dd4296e0c72efdcd424188ea7b1e1de96acb884c6579c On any require of the package, index.js loads polyfill.js which downloads a platform-specific binary from obfuscated Cloudflare Workers hosts...

ROOT-APP-PYPI-CVE-2026-44681 CVE-2026-44681 in Authlib - Patched by Root

Root has patched CVE-2026-44681 in the Authlib package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-28802 CVE-2026-28802 in Authlib - Patched by Root

Root has patched CVE-2026-28802 in the Authlib package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-JJ8C-MMJ3-MMGV GHSA-jj8c-mmj3-mmgv in Authlib - Patched by Root

Root has patched GHSA-jj8c-mmj3-mmgv in the Authlib package for Root:PyPI. Multiple fixed versions available...

Malicious code in simple-date-formatter-util-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6c0d10eabca0cef05a136e2ffd68781a965747ad1e75bf9fd9528292bbe429 The package is advertised as a date-formatting utility but its package.json postinstall script curls cloud-provider instance metadata endpoints AWS...

MAL-2026-11501 Malicious code in simple-date-formatter-util-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6c0d10eabca0cef05a136e2ffd68781a965747ad1e75bf9fd9528292bbe429 The package is advertised as a date-formatting utility but its package.json postinstall script curls cloud-provider instance metadata endpoints AWS...

ROOT-APP-NPM-CVE-2026-45740 CVE-2026-45740 in protobufjs - Patched by Root

Root has patched CVE-2026-45740 in the protobufjs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-44288 CVE-2026-44288 in protobufjs - Patched by Root

Root has patched CVE-2026-44288 in the protobufjs package for Root:npm. Multiple fixed versions available...

CVE-2026-12259

In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...

UBUNTU-CVE-2026-12259

In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...

EUVD-2026-52226

In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...

CVE-2026-12259

The CVE affects nltk 3.9.4: nltk.downloader.Downloader._download_package() can write package bytes to disk and may extract them before SHA-256/MD5 checks, enabling tampering via compromised mirrors or proxies. This could lead to installation of attacker-controlled package bytes (potentially malic...

CVE-2026-12259

In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...

CVE-2026-12259

In nltk version 3.9.4, the nltk.downloader.Downloader.downloadpackage function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for info.url through a compromised...

ae.teletronics.nlp:entityextraction (>=1.3, <=1.4), ai.h2o:h2o-app (>=0.1.22, <=0.1.25) +1041 more potentially affected by CVE-2026-58059 via org.bouncycastle:bcprov-jdk15 (>=1.38, <=1.46)

org.bouncycastle:bcprov-jdk15 MAVEN version =1.38, =1.3, =0.1.22, =0.1.22, =1.0.0, =2.1.0, =1.0.1, =4.2.0, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.0.3, =1.3.3 and more Source cves: CVE-2026-58059 Source advisory:...

app.cash.backfila:client-misk (>=0.1.0, <=2023.11.24.141218-0357917), app.cash.backfila:client-misk-dynamodb (>=0.1.3-20210127.1838-76ab4fc, <=0.1.4-20210806.0204-5341f38) +1468 more potentially affected by CVE-2026-12860 via org.bouncycastle:bcprov-ext-jdk15on (>=1.47, <=1.70)

org.bouncycastle:bcprov-ext-jdk15on MAVEN version =1.47, =0.1.0, =0.1.3-20210127.1838-76ab4fc, =0.1.3-20210127.1838-76ab4fc, =0.1.3-20210805.0116-93702c4, =0.1.3-20210805.0116-93702c4, =0.1.0, =2023.06.07.114626-93b9d6f, =0.1.0, =0.1.4-20220614.0152-5ae0eef, =3.0.1, =2.10.0-11-1, =1.1.5, =1.0.2,...

com.github.mizosoft.methanol:benchmarks (>=1.1.0, <=1.2.0), com.github.mizosoft.methanol:methanol-testutils (>=1.1.0, <=1.2.0) +35 more potentially affected by CVE-2026-58060 via org.bouncycastle:bcprov-debug-jdk15on (>=1.53, <=1.70)

org.bouncycastle:bcprov-debug-jdk15on MAVEN version =1.53, =1.1.0, =1.1.0, =0.8.635, =0.8.635, =0.8.635, =0.8.635, =0.0.1, =4.4.0, =1.3.8, =1.3.7, =1.3.7, =1.3.8, =1.4.0 - de.ohmesoftware:keytool 0.0.2 and more Source cves: CVE-2026-58060 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519187...

ae.vigilancer.android-run-app:ae.vigilancer.android-run-app.gradle.plugin (>=1.0.1, <=1.0.2), aero.m-click:mcpdf (>=0.2.3, <=0.2.10) +21437 more potentially affected by CVE-2026-12802 via org.bouncycastle:bcpkix-jdk15on (>=1.47, <=1.70)

org.bouncycastle:bcpkix-jdk15on MAVEN version =1.47, =1.0.1, =0.2.3, =4.4.0.0, =0.1.12, =0.1.2, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.24 and more Source cves: CVE-2026-12802 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519220...

com.github.mizosoft.methanol:benchmarks (>=1.1.0, <=1.2.0), com.github.mizosoft.methanol:methanol-testutils (>=1.1.0, <=1.2.0) +35 more potentially affected by CVE-2026-12803 via org.bouncycastle:bcprov-debug-jdk15on (>=1.53, <=1.70)

org.bouncycastle:bcprov-debug-jdk15on MAVEN version =1.53, =1.1.0, =1.1.0, =0.8.635, =0.8.635, =0.8.635, =0.8.635, =0.0.1, =4.4.0, =1.3.8, =1.3.7, =1.3.7, =1.3.8, =1.4.0 - de.ohmesoftware:keytool 0.0.2 and more Source cves: CVE-2026-12803 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18519158...