MAL-2026-10507 Malicious code in nodemon-delog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea1c5b4054d6daffaf190005db661027e29255ae20de1bb410f506de1f178532 nodemon-delog is published under a name that resembles the widely-used nodemon package and ships a verbatim copy of nodemon's source tree, README,...

MAL-2026-10508 Malicious code in nodemon-elint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 869b2e1ce23c7668369cd6316bca7d3f8a564fa575ebbee8d1e3cf6a68d4ccaa [email protected] copies the source tree, README, author metadata, and homepage of the legitimate nodemon package but is published under a...

CVE-2026-55773

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. In versions prior to 2.3.6, 3.4.1 and 4.9.0, under certain circumstances, improper input handling could allow Cedar-expression injection via unescaped toCedarExpr. The...

MAL-2026-10460 Malicious code in datavaultx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbf831f155eb2a6d04427e5cc3cd239055844e80c3b02576a5d546e4e7ab42b6 On require of the package's main entry auth.js - lib/writer.js, the module attempts require'auth-gen-next'; on failure it invokes execSync'npm instal...

PYSEC-2026-2564 LangChain vulnerable to unsafe deserialization of attacker-controlled objects through overly broad `load()` allowlists

LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call load with allowedobjects="all". This does not enable arbitrary Python object deserialization, but it does allow...

Malicious code in fetchcraft (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1a40f1af8ba957a18b37ddba0dbe5634112f489841b22208eff421f9a09f786 package.json declares the runtime dependency node-runtime-utils as https://github.com/Hexa-devy/node-runtime-utils/archive/refs/heads/main.tar.gz — a...

MAL-2026-10435 Malicious code in fetchcraft (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1a40f1af8ba957a18b37ddba0dbe5634112f489841b22208eff421f9a09f786 package.json declares the runtime dependency node-runtime-utils as https://github.com/Hexa-devy/node-runtime-utils/archive/refs/heads/main.tar.gz — a...

MAL-2026-10408 Malicious code in chain-js-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a928356b1418a88bc30f460c42b1d9f3050ca3e67deb674307269a8c752d1d8 The package impersonates pino ships pino's docs and headers, exports a pino alias but its actual runtime is an Express middleware factory in file.js...

Malicious code in dotnet-runtime-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c10c75766303f8c3bf261487e341e537f103116026309006ab71d977aacdd235 The package's postinstall lifecycle script package.json line 7: "postinstall": "node install.js" runs install.js, which on Windows writes a PowerShel...

MAL-2026-10211 Malicious code in react-next-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 286869faf09aec1d62b472e43a7188a1583c5cf8c999d1fb2e116f0b7f5ba8c6 The package impersonates the pino logger README/badges reference pino; module.exports.pino is the middleware while its name is react-next-vite. When ...

[SECURITY] Fedora 43 Update: libXfont2-2.0.8-1.fc43

X.Org X11 libXfont2 runtime library...

CVE-2026-61454

The Grav Admin2 plugin getgrav/grav-plugin-admin2 before 2.0.4 embeds a global JavaScript variable window.GRAVCONFIG in the Admin2 SPA bootstrap page at /grav/admin and its subroutes. This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base...

CVE-2026-61454 Grav before 2.0.4 Information Disclosure via __GRAV_CONFIG__

The Grav Admin2 plugin getgrav/grav-plugin-admin2 before 2.0.4 embeds a global JavaScript variable window.GRAVCONFIG in the Admin2 SPA bootstrap page at /grav/admin and its subroutes. This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base...

MAL-2026-10185 Malicious code in authvaultx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6c707d53e30a333f8b8cf03ac2480eee3e2fa9c3c3164b1a100d333c91f9f3a On require of authvaultx main: auth.js, which loads lib/writer.js, top-level code attempts to load the separately published npm package...

PT-2026-57442

Name of the Vulnerable Software and Affected Versions Grav Admin2 plugin versions prior to 2.0.4 Description The plugin embeds a global JavaScript variable window. GRAV CONFIG in the Admin2 SPA bootstrap page at the '/grav/admin' endpoint and its subroutes. This object is returned in every...

CVE-2026-14480

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename progfile directly into the Programs.File database field and later uses this value as the destination path for an...

CVE-2026-47261

A flaw was found in Wasmtime, a runtime for WebAssembly. This vulnerability allows an attacker to bypass intended access controls when a filesystem preopen is configured with read-only file permissions but also allows directory mutations. By using specific open flags, an attacker can truncate fil...

MAL-2026-10177 Malicious code in @jaymara/jsononifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ade6fb9a07c6f1417e9569af48b6c638bf12fba7540493b1b38a2d6ba42d101c @jaymara/[email protected] is advertised as a JSON formatting utility but ships a covert command-execution primitive that fires on require. index.js...

CVE-2026-54063

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. Prior to 2.11.0, the checkSheet function in github.com/xuri/excelize/v2 uses an attacker-controlled XML attribute value directly as the length argument to makexlsxRow, row without validating it against the Exc...

MAL-2026-10133 Malicious code in stella-ai-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 936d3c8bc6611b58f5321ba5aab651bb3d2db821d172816283ca04633be00863 The stella CLI shipped in bin/stella.js prompts users for their phone number and the WhatsApp verification code and POSTs both to a hardcoded bare-IP...