CVE-2026-56434 affecting package nginx for versions less than 1.28.3-8

CVE-2026-56434 affecting package nginx for versions less than 1.28.3-8. A patched version of the package is available...

CVE-2026-11856 affecting package cmake for versions less than 3.30.3-15

CVE-2026-11856 affecting package cmake for versions less than 3.30.3-15. A patched version of the package is available...

CVE-2026-60082 affecting package perl-DBI for versions less than 1.651-1

CVE-2026-60082 affecting package perl-DBI for versions less than 1.651-1. An upgraded version of the package is available that resolves this issue...

MAL-2026-11000 Malicious code in application-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07fa5354b40e3efac6ff8738892aa26cb710e6aff3caca516f563502ef4a4d43 On npm install, scripts.postinstall runs test.js which performs three attacker-beneficial actions against the installer's host. 1 Backdoor: fetches a...

MAL-2026-11007 Malicious code in web3-terminal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bff469765665422f3b9a6dd9978d99ddab9f853b02109f154c97b634977cf223 On npm install, package.json scripts.postinstall runs test.js, which invokes routines in index.js that 1 walk the current working directory for id.js...

Malicious code in encrypt-string-ttak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf72c81030b9346ff3d3dd6f2e5f3395a61d433def25e5e2ea2a7e52a6051999 The package is published as a UniApp 'encryptString' helper but its single shipped module dist/encrypt-string.js is heavily obfuscated obfuscator.io...

Malicious code in encryptstringadmin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e396a16fd1b6b8b6d95060cebd22a123190c015f3de07a3763a872048175139 index.js is a heavily obfuscated loader rotated string-array decoder, control-flow flattening, self-defending/console-tamper stubs, debug-protection...

MAL-2026-11012 Malicious code in encryptstringadmin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e396a16fd1b6b8b6d95060cebd22a123190c015f3de07a3763a872048175139 index.js is a heavily obfuscated loader rotated string-array decoder, control-flow flattening, self-defending/console-tamper stubs, debug-protection...

Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

MAL-2026-11013 Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...

GO-2026-6037 Gitea: Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload in gitea.dev

Gitea: Denial of Service CPU & Memory Exhaustion via ON^2 String Concatenation in Debian Package Upload in gitea.dev...

Malicious code in app-data-ist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37bd61826219d14386d02eed926659dfcfcac94d7b414ae6dd6bcdd4a039fab3 On npm install, the package's postinstall hook node test.js auto-executes multiple attacker-controlled operations against the installer's machine. 1...

GHSA-C97M-VXHJ-P7J6 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cognitoidentity, crossplane-provider-aws-macie2, crossplane-provider-gcp-beta-networksecurity, gptscript, crossplane-provider-azure-resources, crossplane, crossplane-provider-aws-elastictranscoder-fips,...

CVE-2026-5160 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cognitoidentity, crossplane-provider-aws-macie2, crossplane-provider-gcp-beta-networksecurity, gptscript, crossplane-provider-azure-resources, crossplane, crossplane-provider-aws-elastictranscoder-fips,...

GHSA-X5MV-8WGW-29HG vulnerabilities

Vulnerabilities for packages: ascan...

CVE-2026-55093 vulnerabilities

Vulnerabilities for packages: ascan...

GHSA-52CP-R559-CP3M vulnerabilities

Vulnerabilities for packages: ts-patch, eslint, prism, sqlpad, vitess, pulumi, lerna, code-server, kubeflow-centraldashboard, opensearch-dashboards...

CVE-2026-59869 vulnerabilities

Vulnerabilities for packages: ts-patch, eslint, prism, sqlpad, vitess, pulumi, lerna, code-server, kubeflow-centraldashboard, opensearch-dashboards...

GHSA-5GVW-P9QM-JGWH vulnerabilities

Vulnerabilities for packages: opensearch, gradle, infinispan, apicurio-registry, zookeeper, scala, thingsboard, spark, tez, apache-nifi, ruby3.2-jrjackson, druid, keycloak-config-cli, wavefront-proxy, logstash, jenkins-plugin-manager, apache-tika, cassandra, strimzi-kafka-operator,...

GHSA-MHM7-754M-9P8W vulnerabilities

Vulnerabilities for packages: opensearch, gradle, infinispan, zookeeper, thingsboard, spark, tez, ruby3.2-jrjackson, druid, keycloak-config-cli, wavefront-proxy, logstash, jenkins-plugin-manager, apache-tika, cassandra, ruby3.3-jrjackson, sonarqube, akhq, flyway, confluent-kafka...