26 matches found
CVE-2026-102276 vulnerabilities
Vulnerabilities for packages: commitizen, unleash, wazuh-dashboard, ts-patch, graalvm, jupyter-base-notebook, lerna, npm, rancher-api-ui, gitlab-rails-ce, authentik, opensearch-dashboards-fips, wazuh-dashboard-fips, unleash-fips, redisinsight, pelias-api, opentelemetry-auto-instrumentations-node,...
GHSA-6J4F-FJ2G-MC7P vulnerabilities
Vulnerabilities for packages: commitizen, unleash, wazuh-dashboard, ts-patch, graalvm, jupyter-base-notebook, lerna, npm, rancher-api-ui, gitlab-rails-ce, authentik, opensearch-dashboards-fips, wazuh-dashboard-fips, unleash-fips, redisinsight, pelias-api, opentelemetry-auto-instrumentations-node,...
npm_poisoning_poc
Guardians 2027 AI package lab Reusable setup for the first Gu...
MAL-2026-11991 Malicious code in verdaccio-tarball-local-storage (npm)
npm/verdaccio-tarball-local-storage is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malicious code in verdaccio-tarball-local-storage (npm)
npm/verdaccio-tarball-local-storage is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malicious code in verdaccio-okta-oauth (npm)
npm/verdaccio-okta-oauth is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republishe...
MAL-2026-11990 Malicious code in verdaccio-okta-oauth (npm)
npm/verdaccio-okta-oauth is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republishe...
Malicious code in cursed-modules (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45b6aab954f9b8edbc759c97eabe39d7a070c4dbe852586422761ad0f8c7ad95 [email protected] executes attacker-controlled code on three separate triggers and operates a bidirectional command channel against a hardcoded...
MAL-2026-6698 Malicious code in cursed-modules (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45b6aab954f9b8edbc759c97eabe39d7a070c4dbe852586422761ad0f8c7ad95 [email protected] executes attacker-controlled code on three separate triggers and operates a bidirectional command channel against a hardcoded...
EUVD-2019-0457
Malware in sbrugna...
Malicious code in melkikh-verdaccio-dc (npm)
The package melkikh-verdaccio-dc was found to contain malicious code...
MAL-2025-26170 Malicious code in melkikh-verdaccio-dc (npm)
The package melkikh-verdaccio-dc was found to contain malicious code...
CVE-2019-14772
verdaccio before 3.12.0 allows XSS...
@adpt/testutils (>=0.1.0-next.1, <=0.4.0-next.6), @lavamoat/git-safe-dependencies (>=0.1.1, <=0.2.1) +6 more potentially affected by CVE-2025-4759 via lockfile-lint-api (>=1.0.7, <=5.9.1)
lockfile-lint-api NPM version =1.0.7, =0.1.0-next.1, =0.1.1, =1.0.0, =4.3.1-test1, =1.3.0, =1.0.1, =4.2.2, =4.3.1, =4.7.0 Source cves: CVE-2025-4759 Source advisory: MEND:CVE-2025-4759...
Cross-site Scripting (XSS)
verdaccio is vulnerable to cross-site scripting XSS. The vulnerability exists as values like props.readMe were not sanitized...
verdaccio cross-site scripting vulnerability
verdaccio is a lightweight private npm registry. A cross-site scripting vulnerability exists in versions prior to verdaccio 3.12.0, which stems from a lack of proper validation of client-side data by the WEB application and can be exploited by an attacker to execute client-side code...
CVE-2019-14772
verdaccio before 3.12.0 allows XSS...
Cross site scripting
verdaccio before 3.12.0 allows XSS...
CVE-2019-14772
Verdaccio (npm private registry) before version 3.12.0 is vulnerable to Cross-Site Scripting (XSS) due to insufficient validation of client-side data by the web application. The issue affects Verdaccio instances running 3.12.0 or migrating to major version >=4.0.0 to fix the vulnerability. No ...
@cloudideaas/hydra (>=1.0.1, <=1.0.22), @drubin/verdaccio-gitlab (0.0.4) +5 more potentially affected by CVE-2019-14772 via verdaccio (>=2.7.4, <=3.8.6)
verdaccio NPM version =2.7.4, =1.0.1, =0.0.0, =0.0.1-beta.6, =1.0.7, =1.0.24 Source cves: CVE-2019-14772 Source advisory: MEND:CVE-2019-14772...