613089 matches found
GHSA-499R-G7PC-VMP9 Composer: Arbitrary file write outside vendor via malicious transitive package name
Summary A maliciously crafted package, published on an untrusted third party repository other than Packagist.org or Private Packagist, can cause Composer to write files outside the vendor/ directory and outside your project, with attacker-controlled content, during a normal install or update...
Composer: Arbitrary file write outside vendor via malicious transitive package name
Summary A maliciously crafted package, published on an untrusted third party repository other than Packagist.org or Private Packagist, can cause Composer to write files outside the vendor/ directory and outside your project, with attacker-controlled content, during a normal install or update...
Updated xmlstarlet package fixes a security vulnerability
The updated package fixes a security vulnerability: XML external entity vulnerability. References: https://lists.fedoraproject.org/archives/list/[email protected] oraproject.org/message/KDR5XRMVBCDZ4HWDCGLKDVKGSCWACG33/...
MGASA-2026-0275 Updated haveged package fixes a security vulnerability
The updated package fixes a security vulnerability: Privilege escalation via command socket. CVE-2026-41054...
Updated haveged package fixes a security vulnerability
The updated package fixes a security vulnerability: Privilege escalation via command socket. CVE-2026-41054...
0xtrails (>=0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, <=0.17.1), 123pancli (1.0.0) +4502 more potentially affected by CVE-2026-67314 via axios (>=1.15.2, <=1.17.0)
axios NPM version =1.15.2, =0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, =0.1.0, =1.1.0, =0.1.0, =1.0.21, =0.1.4, =0.1.0, =1.0.10, =1.0.10, =0.6.6, =0.6.10, =0.6.9, =0.6.15 - @0xdeepak/wallets 0.0.2 and more Source cves: CVE-2026-67314 Source advisory: OSV:GHSA-XJ6Q-8X83-JV6G...
@0xjwlabs/discord-rpc (0.1.0), @0xsquid/react-hooks (>=1.0.0, <=2.0.0) +1568 more potentially affected by CVE-2026-67312 via axios (>=0.28.0, <=0.32.0)
axios NPM version =0.28.0, =1.0.0, =3.0.0-beta.0, =2.10.1, =1.0.0, =1.0.0, =0.1.0, =0.0.1, =0.0.2, =1.3.2, =1.4.13, =13.0.0, =16.5.4 and more Source cves: CVE-2026-67312 Source advisory: OSV:GHSA-PMV8-RQ9R-6J72...
-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +19071 more potentially affected by CVE-2026-67312 via axios (>=1.0.0, <=1.17.0)
axios NPM version =1.0.0, =0.0.8, =0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, =1.0.53, =0.1.0, =1.0.1, =1.0.0, =0.1.0, =0.0.1, =0.0.1, =0.1.2, =1.1.0, =2.0.0 and more Source cves: CVE-2026-67312 Source advisory: OSV:GHSA-PMV8-RQ9R-6J72...
-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +19071 more potentially affected by CVE-2026-67312 via axios (>=1.0.0, <=1.17.0)
axios NPM version =1.0.0, =0.0.8, =0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, =1.0.53, =0.1.0, =1.0.1, =1.0.0, =0.1.0, =0.0.1, =0.0.1, =0.1.2, =1.1.0, =2.0.0 and more Source cves: CVE-2026-67312 Source advisory: SNYK:JS-AXIOS-18060165...
Malicious code in iot-kfh-s3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c402827c1e00592a8936a9304c2cccc45189126fc447038f67350a8a9124c81 The package's preinstall script executes node examples/verify.js, which initializes Sentry against a hardcoded author-controlled DSN at...
Malicious code in alb-lambda-cdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27e7f2cab2ae9d15c37e236190c685c42b7d3a0ecf92b7b72e9ad00b936ff186 Package name suggests an AWS CDK construct for ALB/Lambda but the shipped code is a thin @sentry/node wrapper. The npm preinstall script runs npm...
Malicious code in lwc-slds-lbc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 935d61576a437061ec8dcb5799e9a40e2798fa900b8e6f5638eeb204dfdf0c79 package.json declares a preinstall script that executes examples/verify.js on npm install. verify.js invokes setUserFromPublicIp from src/index.js,...
MAL-2026-10921 Malicious code in iot-kfh-s3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c402827c1e00592a8936a9304c2cccc45189126fc447038f67350a8a9124c81 The package's preinstall script executes node examples/verify.js, which initializes Sentry against a hardcoded author-controlled DSN at...
MAL-2026-10924 Malicious code in s3-lambda-dynamodb-cdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6517c8914c4ba64ce57809484229df7fbe5dd9f5129c40b19cec8a73c10a70ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in lambda-cloudwatch-cdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d62c2ab5388572a03d3c4f28ee268d562675a2ebbff48cf1375728f837365f4 The package's preinstall script npm install @sentry/node && node examples/verify.js executes on npm install and initializes Sentry with a hardcoded...
MAL-2026-10922 Malicious code in lambda-cloudwatch-cdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d62c2ab5388572a03d3c4f28ee268d562675a2ebbff48cf1375728f837365f4 The package's preinstall script npm install @sentry/node && node examples/verify.js executes on npm install and initializes Sentry with a hardcoded...
MAL-2026-10920 Malicious code in alb-lambda-cdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 27e7f2cab2ae9d15c37e236190c685c42b7d3a0ecf92b7b72e9ad00b936ff186 Package name suggests an AWS CDK construct for ALB/Lambda but the shipped code is a thin @sentry/node wrapper. The npm preinstall script runs npm...
MAL-2026-10923 Malicious code in lwc-slds-lbc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 935d61576a437061ec8dcb5799e9a40e2798fa900b8e6f5638eeb204dfdf0c79 package.json declares a preinstall script that executes examples/verify.js on npm install. verify.js invokes setUserFromPublicIp from src/index.js,...
MAL-2026-10918 Malicious code in automatic-octo-invention (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2dfb4e3eedab24e355b6d24db6096e6752563e220d28e83ad2cf213fe49fd89 The package ships an 8.6 MB stripped ELF binary at automaticoctoinvention/claw sha256 f6fe45f8fe9081987505af31f0249021a65b558af514f2e4e37340fb3182805...
golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass
A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting XSS attacks in applications. Such attacks can result in information...