Malicious Package

Overview flow-parser-oxidized is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in flow-parser-oxidized

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-4294 Malicious code in flow-parser-oxidized (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 656e2f1d3b8c65b9726bb52918453404799c461b0db5ae89061e6b740aa4862d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Hackney security vulnerabilities

Hackney is a program library from Hackney, Inc. A security vulnerability exists in Hackney versions 2.0.0-beta.1 through prior to 4.0.1, which stems from the Alt-Svc response header parser's inability to guarantee forward progress, potentially leading to infinite loops and CPU exhaustion...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via the toString function in the AST Serialization. An attacker can cause uncontrolled recursion by providing specially crafted input, potentially resulting in resource exhaustion and application unavailability...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via the toString function in the AST Serialization. An attacker can cause uncontrolled recursion by providing specially crafted input, potentially resulting in resource exhaustion and application unavailability...

org.webjars.npm:coreui__coreui (4.2.1), org.webjars.npm:css-loader (>=2.1.0, <=6.7.2) +19 more potentially affected by CVE-2026-9358 via org.webjars.npm:postcss-selector-parser (>=4.0.0-rc.1, <=7.1.0)

org.webjars.npm:postcss-selector-parser MAVEN version =4.0.0-rc.1, =2.1.0, =3.1.0, =7.0.1, =4.0.2, =2.0.6, =2.1.0, =4.1.2, =6.2.0 and more Source cves: CVE-2026-9358 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16873883...

UBUNTU-CVE-2026-9358

A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The...

CVE-2026-9358

A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The...

CVE-2026-9358 postcss-selector-parser AST Serialization container.js toString recursion

A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The...

@archon-research/design-system (>=0.1.0-dev25004766367, <=1.0.0-rohit-ds-tokens-and-primitives.1), @archon-research/mcp-connect (>=0.7.0-rohit-magnitude-valuetext.1, <=1.0.0-rohit-ds-tokens-and-primitives.1) +445 more potentially affected by CVE-2026-9358 via postcss-selector-parser (>=7.1.0, <=7.1.2)

postcss-selector-parser NPM version =7.1.0, =0.1.0-dev25004766367, =0.7.0-rohit-magnitude-valuetext.1, =1.0.3, =1.11.1, =1.11.1, =1.11.1, =1.12.0, =1.11.1, =1.11.1, =1.11.1, =1.11.1, =1.11.1, =1.11.1, =1.13.1, =1.19.0 - @cashfreepayments/cashfree-here 1.0.1 and more Source cves: CVE-2026-9358...

CVE-2026-9358

A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The...

@ahnlabcloudmate/design-system (>=0.0.1-beta.0, <=0.2526.3), @azu/eslint-plugin-panda-oxc (>=1.0.1, <=1.0.2) +219 more potentially affected by CVE-2026-9358 via postcss-selector-parser (>=6.1.0, <=6.1.2)

postcss-selector-parser NPM version =6.1.0, =0.0.1-beta.0, =1.0.1, =0.0.3, =0.0.1, =0.0.1, =0.0.1, =0.0.4, =0.0.3, =0.0.3, =0.0.1, =0.0.1, =0.0.9, =0.0.1, =0.0.4, =0.0.32 and more Source cves: CVE-2026-9358 Source advisory: MEND:CVE-2026-9358...

OSV-2026-807 Security exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.statement

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=515650237 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.statement java.base/jdk.internal.misc.Unsafe.weakCompareAndSetInt...

OSV-2026-806 Security exception in com.code_intelligence.jazzer.sanitizers.RegexInjection.hookInternal

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=515796208 Crash type: Security exception Crash state: com.codeintelligence.jazzer.sanitizers.RegexInjection.hookInternal com.codeintelligence.jazzer.sanitizers.RegexInjection.patternHook...

PT-2026-45895

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=515796208 Crash type: Security exception Crash state: com.code intelligence.jazzer.sanitizers.RegexInjection.hookInternal com.code intelligence.jazzer.sanitizers.RegexInjection.patternHook...

PT-2026-45896

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=515650237 Crash type: Security exception Crash state: com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.statement java.base/jdk.internal.misc.Unsafe.weakCompareAndSetInt...

CVE-2026-9358: Uncontrolled Recursion

A vulnerability was determined in postcss-selector-parser up to 6.1.2/7.1.2. Affected is the function toString of the file src/selectors/container.js of the component AST Serialization. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack remotely. The...

Cross-site Scripting (XSS)

Overview golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the writeQuoted function, which does not properly handle characters in DOCTYPE data. An attacker can cause the...

Cross-site Scripting (XSS)

Overview golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the childTextNodesAreLiteral function in render.go. An attacker can cause the execution of scripts in the context o...