Malicious code in @mastra/fastembed (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3de0aac9c375829f2d4e5e18551958ee9000b1f9237f302c91178e0b52b8746 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5946 Malicious code in @mastra/editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b30eb1bb672113816f02b78c98eb64ed613f49acdb94a706c7abf2418670f31 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/dynamodb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2567710170942391d967675952bbdd9cd0f8d933cc39e4cf4460ca4c5b700097 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5939 Malicious code in @mastra/ai-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98257d70b56e46a3dcd690478b15c54fb55c270db969b777c0cb42bec21ace37 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @mastra/pg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a70008c61b1e4ef205086d9fbbeb0435c8cee10e414626617fec6b946d45c84 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

PT-2026-50504

Name of the Vulnerable Software and Affected Versions RTI Connext Professional versions 6.1.0 through 6.1.x RTI Connext Professional versions 7.0.0 through 7.3.1.2 RTI Connext Professional versions 7.4.0 through 7.6.x Description An out-of-bounds write issue exists within the Queueing Service, Co...

OpenStack Nova: Nova scheduler hint injection bypasses Placement resource claims and scheduling constraints

Affects - Nova: =18.0.0 =32.0.0 =33.0.0 33.0.2 Description Erichen from the Institute of Computing Technology, Chinese Academy of Sciences reported that Nova's server create API does not strip internal scheduler hints. An authenticated user can bypass Placement resource claims and scheduling...

EUVD-2026-37217

In PostWipeData of recoveryui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0134

In PostWipeData of recoveryui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

MAL-2026-5912 Malicious code in js-digest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52847ff329757e0777e62c1c060455abc4ddd6f002c295a7f38d0e0489daf76f Package impersonates crypto-js: name is js-digest but package.json carries crypto-js's exact description "JavaScript library of cryptography...

MAL-2026-5921 Malicious code in proto-bin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1994859460fe293cad87eadf5c704e5c717c71deaaf54842f5e29fce765f99d5 Package is advertised as a prototype utilities library pack/unpack/checksum but its exported pack function calls an internal fetch that downloads a...

CVE-2026-0134

CVE-2026-0134 describes a data persistence issue in PostWipeData within recovery_ui.cpp, exposing local information after a factory reset due to a logic error. Impact is information disclosure with no additional privileges required and no user interaction needed. The available documents do not sp...

CVE-2026-0134

In PostWipeData of recoveryui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

MAL-2026-5888 Malicious code in middleware-jwt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32bc5304d92b1d80c7332d9177259c85486b3d272834f3a585a51aa44b7dac4c The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in redis-xyz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71aef015c4f0fbe383030f3e610e18f548dec6e38a52b294ef9b6c8da462d07d The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5882 Malicious code in redis-type-os (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f9fefcfb296b7a9b0c08dc47f628f1987d349d5b57cc9b3c5cb2ce7e331f7e4 Package is published as redis-type-os but all in-package references README, docs/, CHANGELOG, repository field, author email point to redis-om /...

Malicious code in redis-type-os (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f9fefcfb296b7a9b0c08dc47f628f1987d349d5b57cc9b3c5cb2ce7e331f7e4 Package is published as redis-type-os but all in-package references README, docs/, CHANGELOG, repository field, author email point to redis-om /...

MAL-2026-5877 Malicious code in check-ulid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea848e496c2022409208a3e4a7d9b364c9437699a15554a5a1ee953d4428f230 check-ulid is a typosquat of the legitimate ulid package README is copied verbatim, homepage and bugs link to github.com/ulid/javascript whose...

Malicious code in hot-validation-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c76065c270ae195ee042c46a6d0ade5737992948d3f3068f367fc6bfef474ce9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vitest-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39810890a1ffc946b3da439738fb619eab1613a775a308d6f248b80b38ce5603 Package vitest-pro is a namespace-abuse lure: its name suggests a vitest extension, but its source tree, README, and main entry lib/nodemailer.js are...