GHSA-982W-2WQP-Q964 vulnerabilities

Vulnerabilities for packages: openjdk-25-openj9, openjdk-26-openj9, openjdk-11-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-21-openj9...

GHSA-48XX-R45R-42QG vulnerabilities

Vulnerabilities for packages: openjdk-25-openj9, openjdk-26-openj9, openjdk-11-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-21-openj9...

CVE-2008-3109 vulnerabilities

Vulnerabilities for packages: openjdk-25-openj9, openjdk-26-openj9, openjdk-11-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-21-openj9...

GHSA-3FX3-QCJV-QR6H vulnerabilities

Vulnerabilities for packages: openjdk-25-openj9, openjdk-26-openj9, openjdk-11-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-21-openj9...

CVE-2008-3115 vulnerabilities

Vulnerabilities for packages: openjdk-25-openj9, openjdk-26-openj9, openjdk-11-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-21-openj9...

GHSA-FJ22-5G9H-44W5 vulnerabilities

Vulnerabilities for packages: openjdk-25-openj9, openjdk-26-openj9, openjdk-11-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-21-openj9...

GHSA-G23F-VWRR-7M5P vulnerabilities

Vulnerabilities for packages: openjdk-25-openj9, openjdk-26-openj9, openjdk-11-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-21-openj9...

GHSA-F5XR-W782-5RG9 vulnerabilities

Vulnerabilities for packages: openjdk-25-openj9, openjdk-26-openj9, openjdk-11-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-21-openj9...

CVE-2008-3112 vulnerabilities

Vulnerabilities for packages: openjdk-25-openj9, openjdk-26-openj9, openjdk-11-openj9, openjdk-17-openj9, openjdk-8-openj9, openjdk-21-openj9...

CVE-2026-9899 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-2PM8-794W-P8M4 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-42266

A flaw was found in JupyterLab, an extensible environment for interactive computing. The PyPI Extension Manager, responsible for installing extensions, failed to properly enforce its allow-list of approved extensions. This vulnerability allowed for the installation of unauthorized extensions from...

CVE-2026-42251

Use of hard-coded credentials in KS-SOMED allowed an unauthorized attacker access to FTP server that hosted the application's update packages. The attacker with these credentials could upload a malicious update file, which then may have been distributed and installed on client machines as a...

CVE-2026-44971

GuardDog is a CLI tool to identify malicious PyPI packages. From 1.0.0 to 2.9.0, the programmatic remote project scanning path rewrites attacker-controlled repository URLs using a blind string replacement and then sends the caller's GitHub credentials with the resulting request. This allows an...

CVE-2026-8421

Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the installpackage method of concrete/controllers/singlepage/dashboard/extend/install.php. An attacker who can cause an authenticated administrator to visit a crafted page, and who has placed or caused a package to be present under...

IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks

Multiple software supply chain attacks have hit the npm ecosystem, with threat actors using both malicious and poisoned versions of over 50 legitimate packages to distribute a Rust-based information stealer and a self-spreading worm, respectively. According to JFrog, the information stealer...

GHSA-9X9P-QF8F-MVJG vulnerabilities

Vulnerabilities for packages: kibana...

CVE-2026-44644 vulnerabilities

Vulnerabilities for packages: kibana...

Malicious code in effect-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05b6ba1ec02dea0ff73e03c34e3fc37cf4982f156578e03e50909b4d1c8ccc47 The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security...

Malicious code in awaitly-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3f926748b1e107755cfd17cb9151edc730b0228b6e857735a6794f8c1e71c65 No concrete indicators of installer-side harm were identified in this package version. No lifecycle hooks fetching remote payloads, no credential-pat...