Malicious code in lint-staged-lint-staged-auth-terser-webpack-plugin (npm)

Source: amazon-inspector 03253bd76fedc24d55504b970d032ee47ad508a341ba8a5531490b0b9ae15ee3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lint-staged-dactyl-optimize-css-assets-webpack-plugin-less (npm)

Source: amazon-inspector 90fedf4b2f7d5f9c62ab838cb326ef31ed83b2bf95b02afbcdea9f615c976407 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in lint-perseus-css-minimizer-webpack-plugin-cygnus (npm)

The package lint-perseus-css-minimizer-webpack-plugin-cygnus was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in lint-dione-publish-prettier-plugin-markdown (npm)

Source: amazon-inspector cff882e7626745936fd70d55ac96b8390b9cd80e97eff19f2a3bb2a37cf345a6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in link-passport-prettier-plugin-markdown-commitizen (npm)

Source: amazon-inspector 997cbb9644d6e2a6ea49c021e47526c36a9c49d25715d531b0e999691733fd1a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in library-prettier-plugin-markdown-alphard-betelgeuse (npm)

Source: amazon-inspector 5dc7128ddccd3f81a83c4a91ce2bfe6370036f9430a0229bb9548409a2beeb82 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in library-quasar-andromeda-terser-webpack-plugin (npm)

Source: amazon-inspector 9782604e3784bcb5e592be57c38e46ddb5fed0911cb299819acd350f717316cf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in library-pulsar-mini-css-extract-plugin-init (npm)

Source: amazon-inspector eff0fb1b97ee68f4cc8f0b9b98ba61800524ef8ebc7b178ab015f3513bcd079d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in levels-optimize-css-assets-webpack-plugin-hermes-callisto (npm)

The package levels-optimize-css-assets-webpack-plugin-hermes-callisto was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in less-optimize-css-assets-webpack-plugin-miranda-algol (npm)

Source: amazon-inspector 0aaa871e18d8615f0e0c18e15bf0a02a74ef0928a0fc68986a09fc66ad5202a4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in less-loader-prettier-plugin-markdown-pino-zephyr (npm)

Source: amazon-inspector 941bbebe0ee4e3f63add6441b1afb4b7612a1b5f5d02337def841b6019fc45b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in less-loader-quantum-miranda-html-webpack-plugin (npm)

Source: amazon-inspector 9f72622ee9f60adeb5f780beefca8e1efd2fb397f3f46dc1ae0ab8ef0a1b15de This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in less-html-webpack-plugin-phoebe-neptune (npm)

Source: amazon-inspector 6233d66c6ce8a24ae4549b43abe8ec5046cc8b0a19973a0bf6447ca912d0408c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

grafana: Grafana: Denial of Service via unbounded memory allocation in plugin resources endpoint

A flaw was found in Grafana. An authenticated user can exploit a vulnerability in the plugin resources endpoint by sending a request that causes unbounded memory allocation. This occurs when the system attempts to read the entire request body into memory. Successful exploitation can lead to an...

GHSA-9GM5-9RFH-M6VX CoreDNS DoH/DoQ/gRPC bypass UPDATE rejection enforced on UDP/TCP

Summary CoreDNS accepted RFC 2136 UPDATE messages over DoH, DoH3, DoQ, and DNS-over-gRPC, then allowed the proxy/forward plugin to send them unchanged to an upstream DNS server. UDP, TCP, and DoT rejected the same opcode before plugin dispatch. If an update-capable upstream trusts CoreDNS's sourc...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.4.8), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.4.8) +3 more potentially affected by CVE-2026-81876 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (5.4.8)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 5.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.4.8 - ca.uhn.hapi.fhir:org.hl7.fhir.validation 5.4.8...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.5.16), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.5.16) +3 more potentially affected by CVE-2026-81876 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (5.5.16)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 5.5.16 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.5.16 - ca.uhn.hapi.fhir:org.hl7.fhir.validation...

info.cqframework:elm-fhir (1.5.4), org.opencds.cqf.cql.ls:cql-ls (1.5.2) +1 more potentially affected by CVE-2026-81876 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.4.8)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - info.cqframework:elm-fhir 1.5.4 - org.opencds.cqf.cql.ls:cql-ls 1.5.2 -...

info.cqframework:elm-fhir (>=1.5.5, <=1.5.7), org.opencds.cqf.cql.ls:cql-ls (>=1.5.3, <=1.5.4) +1 more potentially affected by CVE-2026-81876 via ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.5.16)

ca.uhn.hapi.fhir:org.hl7.fhir.validation MAVEN version 5.5.16 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.validation and may be impacted: - info.cqframework:elm-fhir =1.5.5, =1.5.3, =1.5.3, =1.5.4 Source cves:...

ca.uhn.hapi.fhir:org.hl7.fhir.convertors (5.4.8), ca.uhn.hapi.fhir:org.hl7.fhir.validation (5.4.8) +3 more potentially affected by CVE-2026-81875 via ca.uhn.hapi.fhir:org.hl7.fhir.r5 (5.4.8)

ca.uhn.hapi.fhir:org.hl7.fhir.r5 MAVEN version 5.4.8 is affected by a known vulnerability. The following packages have a transitive dependency on ca.uhn.hapi.fhir:org.hl7.fhir.r5 and may be impacted: - ca.uhn.hapi.fhir:org.hl7.fhir.convertors 5.4.8 - ca.uhn.hapi.fhir:org.hl7.fhir.validation 5.4.8...