CVE-2026-18651

A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed...

Last.fm Rotation 1.0 - Path Traversal

Directory traversal vulnerability in lastfm-proxy.php in the Last.fm Rotation lastfm-rotation plugin 1.0 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the snode parameter. id: CVE-2014-5181 info: name: Last.fm Rotation 1.0 - Path Traversal author: DhiyaneshDK...

MAL-2026-11484 Malicious code in simple-date-formatter-util-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf71be7a588ae717e33fc9fe98c246a1037e8a38d385a18104a5c0fe8ff1f659 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11455 Malicious code in allurectl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81cc68a7fe1c39ad33325aeb049148b1165f9d8d85c14329094de9912305e325 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11466 Malicious code in hit-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8dce1db42ec3c0d5758c442c943859f877d4cc877644cc4116df2678ab8b0527 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11472 Malicious code in mcp-server-boilerplate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51e3c940b9fc50ad864429da89bf924d2bd1c0253ac8bde66b0b82643260eb51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11469 Malicious code in iwomm-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08d6809ceef0debeef4bcdc1bc305ec5066eceb56a9ad6a17268e0edf87c919b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11465 Malicious code in hazmat-cfr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d2d599c1ab0aeeeee36cccef36e04b2e89220aa8078c379df1b9aef50f55aee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11462 Malicious code in fast-csv-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca3596032239f2a982b11e2846e8af25975d77f3f7c211a32f68e5a451ead883 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-15144 @fastify/rate-limit vulnerable to rate-limit bypass via IPv6 address rotation

@fastify/rate-limit before 11.2.0 keys rate-limit buckets by the verbatim client IP string returned from request.ip. Because a single IPv6 client can control a large address range a /64 holds 2^64 distinct addresses and the same address has multiple valid textual representations, an IPv6 capable...

Pocket ID: OIDC refresh token flow bypasses authorization revocation, account disabling, and group restrictions

OIDC Refresh Token Flow Bypasses Authorization Revocation, Account Disabling, and Group Restrictions Summary The createTokenFromRefreshToken function oidcservice.go:451 validates the refresh token's cryptographic integrity but does not re-validate the user's current authorization state before...

Malicious code in @vaultflow/create-flow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b81295a1f555aeb9d4dc881826920dc2d298aaaa65539dc30aa8f3b01031246 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-12383

A flaw was found in the Event-Driven Ansible EDA server. The ExternalEventStreamViewSet uses permissive access controls permissionclasses=AllowAny, authenticationclasses= and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a...

Malicious code in stargateproxyserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 30672bc5027216bfe87a3a8c7687d7fbd70194afcd47f548712390b1289d3241 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in demo-awesome-date-parser-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dac7edbd7a941a69901501e2f602b37a483dde93aac9af9270f146fea0e7992 The package advertises itself as a date parser but the public API demoParseDate performs several unrelated hostile actions against the calling...

MAL-2026-11053 Malicious code in app-data-lts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 82f35120670504586b6090e4cac9dd795b88170e1da09a6f0ad6955b665a6cda Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11032 Malicious code in chai-as-stringify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06bb8071b2894038268bb513310437eed2c6ffc3aa534c8fae8b8273d7f56a9d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11033 Malicious code in eth-codergen (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69eee48bc43bf04d3a35021657809e8e2615ae84250ee1e7b229175969807a25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11030 Malicious code in vitest-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5309dc413289d10c8d1cf1b2593f5e29c7810c23f60cb8e2c7709884cdba4c04 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11013 Malicious code in encryptstringadmincore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb9468e3d6f153d718527bb4350b6593d64b67cf16b5b81cdf56e4781d1b483 The package's main module core.js is heavily obfuscated obfuscator.io-style string-array with self-defending anti-debug and control-flow flattening a...