PT-2026-49747

Name of the Vulnerable Software and Affected Versions update disk psu baseline.sh affected versions not specified Description The script update disk psu baseline.sh requires the password to be provided in plain text, which may expose sensitive credentials. Recommendations At the moment, there is ...

PT-2026-50042

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Configure to Order versions 12.2.3 through 12.2.15 Description An issue exists in the Supply to Order Workbench component of the Oracle Configure to Order product. A low privileged attacker with network access via HTTP...

PT-2026-49831

Name of the Vulnerable Software and Affected Versions Real Testimonials Pro affected versions not specified Product Slider Pro for WooCommerce affected versions not specified Smart Post Show Pro affected versions not specified Description A supply chain compromise occurred where attackers...

Malicious code in lab-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bbde4e4075983db0c5aba255bc29f84fb2536681b13e8289412cce5c3ee7a2e On npm install, the package's postinstall hook runs seccheck.js, which enumerates the host's network interfaces and proceeds only if an IPv4 address...

@aligent/cdk-esbuild (>=2.0.0, <=2.1.0), @aligent/cdk-graphql-mesh-server (>=0.1.5, <=2.17.0) +609 more potentially affected by CVE-2026-11417 via aws-cdk-lib (>=2.0.0, <=2.245.0)

aws-cdk-lib NPM version =2.0.0, =2.0.0, =0.1.5, =2.3.7, =2.0.1, =2.0.0, =2.0.0-beta, =0.0.3, =1.2.15, =5.0.0-ampgenconfig.0, =2.7.0-a-cdkv2-graphql-15.0, =5.0.0-beta.0, =4.1.10-alpha.74, =3.0.0-ampgenconfig.0, =3.7.28 and more Source cves: CVE-2026-11417 Source advisory: OSV:GHSA-999R-QQ7V-R334...

Malicious code in tn-advertisement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b13ed4147b360eee88a36d9fe649dccbef37cf9019072841e697b88b6e4d3d2 On require, index.js performs an unconditional http.get to a unique subdomain of oastify.com Burp Suite Collaborator out-of-band testing...

MAL-2026-5838 Malicious code in tn-advertisement (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b13ed4147b360eee88a36d9fe649dccbef37cf9019072841e697b88b6e4d3d2 On require, index.js performs an unconditional http.get to a unique subdomain of oastify.com Burp Suite Collaborator out-of-band testing...

10minions-engine (>=0.0.1, <=0.0.4), @1amageek/document-propagator (>=0.10.1, <=1.0.0) +1541 more potentially affected by CVE-2026-54271 via protobufjs-cli (>=1.0.0, <=1.2.2)

protobufjs-cli NPM version =1.0.0, =0.0.1, =0.10.1, =1.1.0, =0.4.0, =1.22.0, =6.2.36, =1.0.0-alpha.2, =1.8.0, =0.0.0-beta.0, =1.0.0, =1.0.1, =3.1.0 and more Source cves: CVE-2026-54271 Source advisory: SNYK:JS-PROTOBUFJSCLI-17362836...

@agentbadge/mcp (0.1.9), @agentbadge/passport (>=0.1.8, <=0.2.1) +104 more potentially affected by CVE-2026-54270 via protobufjs (>=8.2.0, <=8.4.2)

protobufjs NPM version =8.2.0, =0.1.8, =0.1.1, =0.1.1, =1.16.0, =1.0.5, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.3.1, =0.1.37, =0.1.41 and more Source cves: CVE-2026-54270 Source advisory: OSV:GHSA-94RC-8X27-4472...

@aamini/config (>=0.0.1, <=0.0.13), @baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.278, <=2.1.0-alpha.281) +6 more potentially affected by CVE-2026-53633 via @vitest/browser-playwright (>=4.0.18, <=4.1.5)

@vitest/browser-playwright NPM version =4.0.18, =0.0.1, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =0.6.0-rc.1, =0.2.0-alpha.1, =0.2.2 Source cves: CVE-2026-53633 Source advisory: SNYK:JS-VITESTBROWSERPLAYWRIGHT-17375133...

10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3460 more potentially affected by CVE-2026-48712 via protobufjs (>=7.0.0, <=7.5.9)

protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =2.0.2, =4.0.1 and more Source cves: CVE-2026-48712 Source advisory: SNYK:JS-PROTOBUFJS-17353320...

@forwardimpact/libcodegen (>=0.1.47, <=0.1.52) potentially affected by CVE-2026-54269 via protobufjs-cli (2.0.1)

protobufjs-cli NPM version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on protobufjs-cli and may be impacted: - @forwardimpact/libcodegen =0.1.47, =0.1.52 Source cves: CVE-2026-54269 Source advisory: SNYK:JS-PROTOBUFJSCLI-17353169...

10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3463 more potentially affected by CVE-2026-54269 via protobufjs (>=7.0.0, <=7.6.2)

protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =2.0.2, =4.0.1 and more Source cves: CVE-2026-54269 Source advisory: OSV:GHSA-F38Q-MGVJ-VPH7...

3nit-utils (>=0.24.0, <=1.0.2), 6ix (0.0.0-canary.0) +304 more potentially affected by CVE-2026-53632 via launch-editor (>=2.2.1, <=2.13.2)

launch-editor NPM version =2.2.1, =0.24.0, =0.0.0-canary.0, =0.0.1, =7.0.2, =1.0.0, =0.4.0, =0.1.0, =0.3.0, =1.0.0, =0.2.0, =0.2.10 - @carnesen/www 0.1.0 - @catapult-tech/cp-design-system-site 1.0.0 - @caviar/cli 0.0.1 and more Source cves: CVE-2026-53632 Source advisory:...

@ablehi/automation-app-build (>=0.1.0, <=0.3.6), @ablehi/automation-app-cli (>=0.1.0, <=0.3.5) +204 more potentially affected by CVE-2026-53571 via vite (>=8.0.0, <=8.0.14)

vite NPM version =8.0.0, =0.1.0, =0.1.0, =0.94.0, =0.1.0, =1.1.2, =1.2.0, =3.0.1-alpha.0, =0.1.0, =0.1.0, =3.3.0, =11.17.0-depup.0, =11.17.2-depup.0 and more Source cves: CVE-2026-53571 Source advisory: SNYK:JS-VITE-17353904...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @aicblock/cli (>=1.0.0, <=1.0.1) +239 more potentially affected by CVE-2026-53571 via vite (>=6.0.0, <=6.4.2)

vite NPM version =6.0.0, =0.0.1, =1.0.0, =1.0.0, =0.2.0, =4.25.19-patch.2, =19.0.0-beta.0, =19.0.0-beta.0, =19.1.0-next.0, =19.1.0-next.0, =6.0.0-beta.1, =6.0.0 and more Source cves: CVE-2026-53571 Source advisory: SNYK:JS-VITE-17353904...

@142vip/vuepress (>=0.0.1-alpha.19, <=0.0.1-alpha.25), @agregio-solutions/design-system (>=1.89.2, <=1.101.1) +248 more potentially affected by CVE-2026-53571 via vite (>=7.0.0, <=7.3.3)

vite NPM version =7.0.0, =0.0.1-alpha.19, =1.89.2, =20.1.0-next.3, =20.1.0-next.3, =0.1.0, =0.0.4, =0.2.9, =0.79.1, =1.0.0, =1.11.1, =1.0.0-beta.23, =2.1.2-alpha.0, =2.23.0, =2.23.0, =2.37.0 and more Source cves: CVE-2026-53571 Source advisory: OSV:GHSA-FX2H-PF6J-XCFF...

MAL-2026-5787 Malicious code in @solana-labs/spl-toke (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e2ec34996ab8cff20d9ba12cd9f5a8a75346c4e5e25d7c3fd5adc7bb7045f64 Package name @solana-labs/spl-toke is a likely confusion-attack against the well-known @solana/spl-token SPL token client missing trailing n, differe...

MAL-2026-5788 Malicious code in @solana-labs/web3js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9bcfcd3a9b7eb540a36cb0d90a75c1e0c94cb5e78e265a85539608e3503a214 Package name @solana-labs/web3js closely resembles the well-known @solana/web3.js library different scope, missing dot in module name. The bundled...

@eui/deps-base (>=19.0.0-next.1, <=19.3.17), @eui/deps-base-light (>=19.0.0-next.1, <=19.3.17) +2 more potentially affected by CVE-2026-50169 via @angular/service-worker (>=19.0.0, <=19.2.20)

@angular/service-worker NPM version =19.0.0, =19.0.0-next.1, =19.0.0-next.1, =0.30.0, =0.30.0, =0.30.1 Source cves: CVE-2026-50169 Source advisory: OSV:GHSA-GV2Q-MQQV-365M...