Malicious code in nodepack-daemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b976e6ab638a52663d25f360bffec6706dc82991ad27c552788a5a4d785ff89f The package presents itself as the popular pino logger README badges, file layout mirroring pino's lib/proto.js, lib/redaction.js, lib/transport.js,...

-llscw-react-cli (>=1.0.0, <=1.1.0), 002-node-cli (1.0.0) +28845 more potentially affected by CVE-2026-39245 via decompress (>=0.1.6, <=4.2.1)

decompress NPM version =0.1.6, =1.0.0, =0.0.1, =0.0.4 - 1095h-cli 1.0.1 - 10secondsofcode-custom 1.0.0 and more Source cves: CVE-2026-39245 Source advisory: SNYK:JS-DECOMPRESS-17937347...

Symlink Attack

Overview decompress is a package that can be used for extracting archives. Affected versions of this package are vulnerable to Symlink Attack in the symlink handling process. An attacker can create arbitrary symbolic links outside the intended extraction directory by crafting an archive with...

Directory Traversal

Overview decompress is a package that can be used for extracting archives. Affected versions of this package are vulnerable to Directory Traversal via improper validation in the safeMakeDir function and extraction path validation process. An attacker can write arbitrary files outside the intended...

ROS-20260710-73-0002

The vulnerability of the HostnameError.Error function in the crypto/x509 package in the Go programming language is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker to cause service failures remotely...

melange: Incomplete package integrity verification allows data section substitution

Previously, Apko verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files that get installed. An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file...

melange: Incomplete package integrity verification allows data section substitution

Previously, Apko verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files that get installed. An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file...

PT-2026-57481

This update for libredwg fixes the following issues: Changes in libredwg: - Update to snapshot 0.14.8413 fix dwg next entity NULL pointer dereference CVE-2026-15184, boo1271170 Fix dwg bmp thumbnail overflow checks CVE-2026-15181, boo1271169 Resolve NULL pointer dereference SEGV in match BLOCK...

RockyLinux 10 : tomcat9 (RLSA-2026:36790)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:36790 advisory. Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor CVE-2026-29146 Apache Tomcat: Apache Tomcat...

Fedora 43 : nmap (2026-602d919dbc)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-602d919dbc advisory. - Fix CVE-2026-58058 rhbz2494410 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

PT-2026-57325

Name of the Vulnerable Software and Affected Versions Frappe versions prior to 16.23.0 Frappe versions prior to 15.112.0 Description A TarSlip Remote Code Execution RCE issue exists in the Package Import feature. This occurs because members of tarfiles are not sufficiently validated before...

RHEL 10 : golang (RHSA-2026:37436)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:37436 advisory. The golang packages provide the Go programming language compiler. Security Fixes: golang.org/x/net/idna: golang: golang.org/x/net/idna:...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the BGP OPEN capability parsing process. An attacker can influence peer AS validation and capability negotiation by sending a specially crafted BGP OPEN message with a malformed capability length, causing the parse...

MAL-2026-10102 Malicious code in dc-repro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b27530f3aa6f2f96c3aa77ffad048e51ee4479d60c81ce59687772b6985a99b On npm install, postinstall.js issues an HTTP GET to a hardcoded bare-IP endpoint at http://130.49.177.51:18080/p/dc-20260627-yandex-geobase carrying...

MAL-2026-10101 Malicious code in date-kit-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce3951661e57807f08fd4dcbf281c14dd1e596907e1a356a3ec503e45fe3b8af The package advertises itself as a lightweight date-formatting utility but its postinstall lifecycle script executes the id command and transmits the...

MAL-2026-10105 Malicious code in pxpure8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a40ae433e9fa90bfbb449d343c281375329a44c0dacf080a91a0c1717579b679 The package's main entry pure.js consists of a single behavior: it creates a element pointing at https://cdn.jsdelivr.net/npm/px8my/px.js no version...

Malicious code in px8my (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7da37dfbaa4b355a75e38c244bc5614299ecc5a1f3bc1dd072fdc7c4f2dc13b9 px8my's main entry is a browser-side script that injects a full-screen iframe pointing at a hardcoded remote URL https://mfmz.gzhrjq.cn/H.html?c=0gjr...

MAL-2026-10104 Malicious code in px8my (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7da37dfbaa4b355a75e38c244bc5614299ecc5a1f3bc1dd072fdc7c4f2dc13b9 px8my's main entry is a browser-side script that injects a full-screen iframe pointing at a hardcoded remote URL https://mfmz.gzhrjq.cn/H.html?c=0gjr...

MAL-2026-10109 Malicious code in validator-string (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 41a95b09ecd097cf7db1496950d26195169adb7ad2d8065a3458771389094be4 Package name validator-string impersonates the widely-used npm package validator and copies its README, homepage, and API surface. package.json...

Malicious code in security-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2450dc325921e41fd15c24339c29dc86bef36424dd6f8447c07cffd219f3955a package.json declares the package's own name as both a dependency and devDependency pointing to http://pack.nppacks.com/npm/security-node, a...