629290 matches found
CVE-2026-63076 affecting package edk2 for versions less than 20240524git3e722403cd16-19
CVE-2026-63076 affecting package edk2 for versions less than 20240524git3e722403cd16-19. A patched version of the package is available...
NPM: n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy
NPM: n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy vulnerability discovered by ? in WordPress Npm n8n versions 2.37.7...
4591-libs (>=0.0.1, <=0.2.0), @10abdullahbutt/nestjs-boilerplate (0.0.1) +1570 more potentially affected by CVE-2026-77063 via multer (>=2.0.0-alpha.2, <=2.2.0)
multer NPM version =2.0.0-alpha.2, =0.0.1, =0.0.1-alpha.1, =0.0.1-alpha.9, =0.0.0-alpha.119, =1.2.1-dev.3, =0.0.1, =1.0.0, =0.1.1, =0.0.1, =0.0.1, =0.0.1, =0.1.0, =0.0.2, =0.0.10, =0.6.2 and more Source cves: CVE-2026-77063 Source advisory: GHSA-QVFW-J98X-7Q72...
NPM: multer vulnerable to Denial of Service via oversized array index in field names
NPM: multer vulnerable to Denial of Service via oversized array index in field names vulnerability discovered by ? in WordPress Npm multer versions 2.3.0...
NPM: morgan vulnerable to Log Forging via unescaped Unicode line separators
NPM: morgan vulnerable to Log Forging via unescaped Unicode line separators vulnerability discovered by ? in WordPress Npm morgan versions 1.12.0...
NPM: Astro: Remote code execution through AVIF image optimization
NPM: Astro: Remote code execution through AVIF image optimization vulnerability discovered by ? in WordPress Npm astro versions 7.2.8...
Composer arbitrary command execution via a malicious package's Perforce source URL
Summary If the p4 Perforce CLI client is installed, a malicious dependency package from a package repository allowing arbitrary perforce source URLs packagist.org is safe could execute arbitrary commands when running composer install or composer update. Composer passed a package's Perforce source...
GHSA-RVX4-FFVW-M9Q3 Composer arbitrary command execution via a malicious package's Perforce source URL
Summary If the p4 Perforce CLI client is installed, a malicious dependency package from a package repository allowing arbitrary perforce source URLs packagist.org is safe could execute arbitrary commands when running composer install or composer update. Composer passed a package's Perforce source...
NPM: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials
NPM: Hono: Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials vulnerability discovered by ? in WordPress Npm hono versions 4.13.5...
NPM: SVGO: removeScripts allows executable links through namespace and control-character bypasses
NPM: SVGO: removeScripts allows executable links through namespace and control-character bypasses vulnerability discovered by ? in WordPress Npm svgo versions = 1.0.0, 2.8.4...
MAL-2026-16050 Malicious code in @aspect-adv-ui/consent-manager (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b30b507d6c71f746b0af2d19cbbb85357f15189e7e93118c75b4cb215adc0ece @aspect-adv-ui/consent-manager 2.4.1 declares a postinstall hook node setup.js that fires automatically on every npm install. setup.js issues an HTTP...
Malicious code in @aspect-adv-ui/consent-manager (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b30b507d6c71f746b0af2d19cbbb85357f15189e7e93118c75b4cb215adc0ece @aspect-adv-ui/consent-manager 2.4.1 declares a postinstall hook node setup.js that fires automatically on every npm install. setup.js issues an HTTP...
Malicious code in @umschool/analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da14c2843514d3c9103335648bc81a8bce18fc173b27c2ab39ebe2c6c0abe028 @umschool/[email protected] targets the internal @umschool npm scope with an implausibly high version number to force resolution over any private...
MAL-2026-16051 Malicious code in @umschool/analytics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da14c2843514d3c9103335648bc81a8bce18fc173b27c2ab39ebe2c6c0abe028 @umschool/[email protected] targets the internal @umschool npm scope with an implausibly high version number to force resolution over any private...
NPM: xmldom: Processing Instruction Target Injection Bypasses requireWellFormed
NPM: xmldom: Processing Instruction Target Injection Bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...
08cms (1.0.0), 0uth (>=1.0.5, <=1.2.1) +12683 more potentially affected by CVE-2026-83608 +1 more via xmldom (>=0.1.2, <=0.6.0)
xmldom NPM version =0.1.2, =1.0.5, =1.0.0, =1.0.0, =1.7.3, =0.1.0, =0.0.2, =0.0.1, =1.0.2, =1.0.3, =1.0.23, =1.0.1, =1.3.1 and more Source cves: CVE-2026-83608, CVE-2026-83613 Source advisory: OSV:GHSA-27P8-2357-5QQV...
NPM: xmldom: DocType `name` Injection Bypasses requireWellFormed
NPM: xmldom: DocType name Injection Bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...
6thbridge-hexa-docs (0.0.1), @12-labours/mapintegratedvuer (>=1.0.0-beta.0, <=1.0.0-beta.14) +1066 more potentially affected by CVE-2026-83618 via @xmldom/xmldom (>=0.9.10, <=0.9.11)
@xmldom/xmldom NPM version =0.9.10, =1.0.0-beta.0, =0.0.1, =0.0.1, =0.0.1, =2.4.4, =0.1.30-develop-map-0, =0.1.0, =0.3.2-beta.0, =0.8.1, =0.1.0, =0.8.0, =0.6.0, =3.4.1 and more Source cves: CVE-2026-83618 Source advisory: GHSA-VR34-HP96-76PP...
NPM: xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content
NPM: xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...