CVE-2026-10032 Arbitrary JavaScript Execution via openUrl in @a2ui/web_core

The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...

MAL-2026-11885 Malicious code in @servicetitan/lazy-module (npm)

npm/@servicetitan/lazy-module is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @or-sdk/web-search (npm)

npm/@or-sdk/web-search is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

MAL-2026-11738 Malicious code in @or-sdk/web-search (npm)

npm/@or-sdk/web-search is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and republished ...

CLSA-2026-1785380881 TuxCare security update for ws (2 CVEs)

TuxCare rebuilt ws to address 2 CVEs. Fixed in 8.16.0-tuxcare.2...

CLSA-2026-1785204378 TuxCare security update for ws (8 CVEs)

TuxCare rebuilt ws to address 8 CVEs. Fixed in 6.2.1-tuxcare.1...

CLSA-2026-1785204343 TuxCare security update for ws (1 CVE)

TuxCare rebuilt ws to address 1 CVE. Fixed in 7.5.9-tuxcare.1...

CLSA-2026-1785204342 TuxCare security update for ws (1 CVE)

TuxCare rebuilt ws to address 1 CVE. Fixed in 8.16.0-tuxcare.1...

CLSA-2026-1784769619 TuxCare security update for ws (5 CVEs)

TuxCare rebuilt ws to address 5 CVEs. Fixed in 4.1.0-tuxcare.2...

CLSA-2026-1776299658 TuxCare security update for http-proxy-middleware (1 CVE)

TuxCare rebuilt http-proxy-middleware to address 1 CVE. Fixed in 0.18.0-tuxcare.1...

CLSA-2026-1774657370 TuxCare security update for jsonwebtoken (5 CVEs)

TuxCare rebuilt jsonwebtoken to address 5 CVEs. Fixed in 0.4.0-tuxcare.1...

CLSA-2026-1774570933 TuxCare security update for http-signature (1 CVE)

TuxCare rebuilt http-signature to address 1 CVE. Fixed in 0.9.11-tuxcare.1...

CLSA-2026-1774225216 TuxCare security update for ws (3 CVEs)

TuxCare rebuilt ws to address 3 CVEs. Fixed in 4.1.0-tuxcare.1...

CLSA-2026-1772583196 TuxCare security update for ws (5 CVEs)

TuxCare rebuilt ws to address 5 CVEs. Fixed in 1.1.1-tuxcare.1...

GHSA-R745-8HWV-H473 Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration

Summary The OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design it is in the public whitelist and performs a server-side HTTP request to a credential-controlled URL accessTokenUrl without SSRF protections. In runtime validation, this...

CVE-2026-67200

CVE-2026-67200 refers to a path traversal in Perspective 5.0.0, exploitable by unauthenticated remote attackers who include literal ../ in HTTP request paths to read arbitrary server files via the cwd_static_file_handler. The vulnerability bypasses insufficient query-string-stripping sanitization...

Malicious code in @hubsync/web-sdk-react (npm)

npm/@hubsync/web-sdk-react is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

Malicious code in @servicetitan/web-components (npm)

npm/@servicetitan/web-components is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-11949 Malicious code in @servicetitan/web-components (npm)

npm/@servicetitan/web-components is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

MAL-2026-12014 Malicious code in @keyv/encrypt-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb40fe6b9df197abf3018c58ce0ab5a9cdb11d3e9bddc636de1779c5c509948c The package contents produced no a static rule matches and no traced behavior indicating credential access, install-time or import-time code executio...