TinaCMS 安全漏洞

TinaCMS is an open-source headless CMS for Markdown, MDX, and JSON developed by Tina. Versions of TinaCMS prior to 2.1.8 contained a security vulnerability. This vulnerability stemmed from the TinaCMS CLI development server’s configuration using Vite, which disabled the built-in file system acces...

PT-2026-25014

Name of the Vulnerable Software and Affected Versions TinaCMS versions prior to 2.1.8 Description TinaCMS is a headless content management system. Before version 2.1.8, the TinaCMS CLI development server configures Vite with server.fs.strict: false, disabling Vite’s built-in filesystem access...

Malicious Package

Overview vite-chunker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1338 Malicious code in vite-chunker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff8c2fc92377d678aca4ddaeaf13ff2c9a3fe7da1e436478d49b935131562f58 The package vite-chunker was found to contain malicious code. Source: ghsa-malware 77cc8d4b3c8ab1dac6606515127cb65f5c6738fb43b9d6a7800351162e689059 A...

Malicious code in vite-chunker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff8c2fc92377d678aca4ddaeaf13ff2c9a3fe7da1e436478d49b935131562f58 The package vite-chunker was found to contain malicious code. Source: ghsa-malware 77cc8d4b3c8ab1dac6606515127cb65f5c6738fb43b9d6a7800351162e689059 A...

📄 Vite 6.2.2 Arbitrary File Read

Proof of concept exploit for an arbitrary file read in Vite version 6.2.2. ============================================================================================================================================= | Title : Vite 6.2.2 Arbitrary File Read – PHP Exploit | | Author : indoushka | ...

Exploit for Improper Access Control in Vitejs Vite

No d...

org.webjars.npm:github-com-datatables-datatablessrc (2.0.5), org.webjars.npm:vite (>=2.9.0, <=6.3.5) +1 more potentially affected by CVE-2026-27606 via org.webjars.npm:rollup (>=2.79.2, <=4.45.1)

org.webjars.npm:rollup MAVEN version =2.79.2, =2.9.0, =6.3.5 - org.webjars.npm:vitepress 1.0.0-draft.8 Source cves: CVE-2026-27606 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15340921...

Malicious code in webpack-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f7b28a9002453a46c97bba5ad0790e13ba1ba656971e78de46edf6efcd53154 The package webpack-vite was found to contain malicious code. Source: ghsa-malware cd525d679fa448615bd48fe06d94f5cd6d94cb97f6ae72ae6afbb179027cce9c A...

MAL-2026-918 Malicious code in webpack-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f7b28a9002453a46c97bba5ad0790e13ba1ba656971e78de46edf6efcd53154 The package webpack-vite was found to contain malicious code. Source: ghsa-malware cd525d679fa448615bd48fe06d94f5cd6d94cb97f6ae72ae6afbb179027cce9c A...

Malicious Package

Overview webpack-vite is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-747 Malicious code in react-vite-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9f5300073ebcda0869cf258bc5c567c6afc40942b14d14a97bfeaa2eaff1b9c The package react-vite-sync was found to contain malicious code. Source: ghsa-malware 971cc1d747c2d072e4a3cc272143be37bbd2162968dfd682012890e87cda562...

Malicious code in react-vite-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9f5300073ebcda0869cf258bc5c567c6afc40942b14d14a97bfeaa2eaff1b9c The package react-vite-sync was found to contain malicious code. Source: ghsa-malware 971cc1d747c2d072e4a3cc272143be37bbd2162968dfd682012890e87cda562...

Malicious code in vite-ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dde7d42b0bc5236d827ba62c883fbf14b643e368ef8a4b0f7b5430a35183254 The package vite-ui-components was found to contain malicious code. Source: ghsa-malware...

MAL-2026-669 Malicious code in vite-ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dde7d42b0bc5236d827ba62c883fbf14b643e368ef8a4b0f7b5430a35183254 The package vite-ui-components was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview vite-ui-components is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CISA Updates KEV Catalog with Four Actively Exploited Software Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday added four security flaws to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation in the wild. The list of vulnerabilities is as follows - CVE-2025-68645 CVSS score: 8.8 - A PHP remote fi...

CISA Adds Four Known Exploited Vulnerabilities to Catalog

CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2025-31125link is external Vite Vitejs Improper Access Control Vulnerability CVE-2025-34026link is external Versa Concerto Improper Authentication Vulnerabilit...

Vite Vitejs Improper Access Control Vulnerability

Vite Vitejs contains an improper access control vulnerability that exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected...

Security Bulletin: Multiple Vulnerabilities in IBM Engineering AI hub.

Summary Multiple vulnerabilities were addressed in IBM Engineering AI Hub version 1.1.0. Vulnerability Details CVEID:CVE-2025-58751 DESCRIPTION: Vite is a frontend tooling framework for JavaScript. Prior to versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20, files starting with the same name with the publi...