GHSA-M93F-WJ8C-RP8P vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

GHSA-9MR8-PWPW-3J2W vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

GHSA-FCCG-MWVH-QQG4 vulnerabilities

Vulnerabilities for packages: flyway-fips, cruise-control, keycloak-fips, floci-az, spark, knative-kafka-broker, neo4j, sonarqube, zookeeper-fips, apache-nifi, kafka, cassandra-reaper, pinot-fips, floci, kayenta, knative-kafka-broker-fips, keycloak, zookeeper, pinot, ghidra, apache-hop,...

ROOT-APP-MAVEN-CVE-2024-29371 CVE-2024-29371 in org.bitbucket.b_c:jose4j - Patched by Root

Root has patched CVE-2024-29371 in the org.bitbucket.bc:jose4j package for Root:Maven. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-9277 CVE-2026-9277 in shell-quote - Patched by Root

Root has patched CVE-2026-9277 in the shell-quote package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2021-42740 CVE-2021-42740 in shell-quote - Patched by Root

Root has patched CVE-2021-42740 in the shell-quote package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2020-7774 CVE-2020-7774 in y18n - Patched by Root

Root has patched CVE-2020-7774 in the y18n package for Root:npm. Multiple fixed versions available...

Malicious code in etoro-cashout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1 The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands whoami, ipconfig/ip addr, directory listin...

MAL-2026-16117 Malicious code in etoro-cashout (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c8aa14d0b9945053b63f4396f09365c5daefec60a25e931f165b3473e7c564f1 The package's preinstall.js lifecycle script runs on npm install and executes host reconnaissance commands whoami, ipconfig/ip addr, directory listin...

Malicious code in etoro-aggregator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7d5f0fb8c06c23afad28686a3d3d689dfc5a3786c73bff2c569fd8b55f2b4ad The package's preinstall.js lifecycle script executes automatically on npm install and performs reconnaissance on the installer host. It collects...

MAL-2026-16111 Malicious code in etoro-aggregator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7d5f0fb8c06c23afad28686a3d3d689dfc5a3786c73bff2c569fd8b55f2b4ad The package's preinstall.js lifecycle script executes automatically on npm install and performs reconnaissance on the installer host. It collects...

MAL-2026-16112 Malicious code in etoro-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfe27d37497e77c8f0eca9105a6b64c646c7ef1439c05ec50edaf40215037f92 [email protected] ships a preinstall lifecycle script preinstall.js that automatically runs on npm install. The script collects installer host...

Malicious code in etoro-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfe27d37497e77c8f0eca9105a6b64c646c7ef1439c05ec50edaf40215037f92 [email protected] ships a preinstall lifecycle script preinstall.js that automatically runs on npm install. The script collects installer host...

Malicious code in etoro-charts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44aff5a1a0b68ff9c9b3456693ef1b8266dce7001dd8b6ff56bed428bbc7c5a On npm install, preinstall.js runs automatically and sends the installer's hostname, username, platform, and current working directory via HTTP GET t...

MAL-2026-16118 Malicious code in etoro-charts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e44aff5a1a0b68ff9c9b3456693ef1b8266dce7001dd8b6ff56bed428bbc7c5a On npm install, preinstall.js runs automatically and sends the installer's hostname, username, platform, and current working directory via HTTP GET t...

Malicious code in etoro-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 385c1c361c59557137d095062a9f767a4c0cd0a1ef78b0b26e4654147e137e3c The package's preinstall.js runs automatically on npm install and collects host identifiers os.hostname, os.userInfo.username, process.cwd,...

CVE-2026-62899 vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

CVE-2026-62901 vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

GHSA-M93F-WJ8C-RP8P vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

CLEANSTART-2026-VO98287 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Multiple security vulnerabilities affect the vault package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. See references for individual vulnerability details...