2099564 matches found
MAL-2026-16386 Malicious code in @mikudeveloper/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d03bf7166a5353a0b22409ebbb724ee53f24394c9ff340df668c970772796e28 This package is a fork of Baileys that declares libsignal in package.json as github:tenka-san/libsignal-node — a git dependency with no commit SHA,...
MAL-2026-16387 Malicious code in @mr-supun-fernando/supunmd-bail (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86c68c82f6ead4ab3b823b81fd6805991bfdd65cdc901d83aeb561cdd8f27b19 package.json declares "libsignal": "github:tenka-san/libsignal-node" — an off-registry dependency source pointing at a personal-user GitHub repositor...
ROOT-APP-GOBINARY-CVE-2026-77410 CVE-2026-77410 in github.com/rabbitmq/amqp091-go - Patched by Root
Root has patched CVE-2026-77410 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2026-79921 CVE-2026-79921 in github.com/rabbitmq/amqp091-go - Patched by Root
Root has patched CVE-2026-79921 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...
ROOT-APP-GOBINARY-CVE-2026-77412 CVE-2026-77412 in github.com/rabbitmq/amqp091-go - Patched by Root
Root has patched CVE-2026-77412 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...
EEF-CVE-2026-86698 Refresh tokens accepted as private repository credentials at the CDN
Summary Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session has ended to keep reading the organization's private packages and their documentation tarballs via a retained refresh token. generaterefreshtoken/4 i...
MINI-X2FW-MG2C-2H55
Bulletin has no description...
MINI-35CJ-MQQG-H6RQ
Bulletin has no description...
MINI-H4VG-XJQQ-RHH2
Bulletin has no description...
MINI-99P2-FGXQ-96VP
Bulletin has no description...
MINI-8G49-32PJ-X475
Bulletin has no description...
MINI-CR3J-MFPG-X64R
Bulletin has no description...
ROOT-APP-MAVEN-AIKIDO-2024-10351 AIKIDO-2024-10351 in org.springframework:spring-webmvc - Patched by Root
Root has patched AIKIDO-2024-10351 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2024-38816 CVE-2024-38816 in org.springframework:spring-webmvc - Patched by Root
Root has patched CVE-2024-38816 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-41845 CVE-2026-41845 in org.springframework:spring-webmvc - Patched by Root
Root has patched CVE-2026-41845 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-41842 CVE-2026-41842 in org.springframework:spring-webmvc - Patched by Root
Root has patched CVE-2026-41842 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2024-38819 CVE-2024-38819 in org.springframework:spring-webmvc - Patched by Root
Root has patched CVE-2024-38819 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...
MINI-FVF4-42CF-C7P9
Bulletin has no description...
MINI-W3MX-FRC9-VQFX
Bulletin has no description...
MINI-8WGQ-6C7F-G8GF
Bulletin has no description...
MINI-2285-5HVM-QMGH
Bulletin has no description...
MINI-8X7G-H48H-6JG5
Bulletin has no description...
MINI-PC43-6F3V-XMVP
Bulletin has no description...
MINI-M9GC-XV7X-7VJJ
Bulletin has no description...
MINI-2835-27MM-RG7P
Bulletin has no description...
MINI-FFGX-X932-F3VV
Bulletin has no description...
MINI-7HPV-4F46-8CRM
Bulletin has no description...
MINI-985X-728W-W44C
Bulletin has no description...
MINI-96WF-W55V-575J
Bulletin has no description...
MINI-5JXW-V4M3-G989
Bulletin has no description...
MINI-QHXH-W8J2-45VX
Bulletin has no description...
MINI-G2Q3-3GCM-XQ57
Bulletin has no description...
MINI-XX5W-M9WX-JF64
Bulletin has no description...
MINI-XWJ7-CX52-J6H3
Bulletin has no description...
MINI-838X-4PPR-C7QJ
Bulletin has no description...
MINI-6V6R-FCCC-JXM3
Bulletin has no description...
MINI-4RC7-8H2R-JC3C
Bulletin has no description...
MINI-37JW-32HW-R2PM
Bulletin has no description...
MINI-JGP8-2QHX-79QX
Bulletin has no description...
MINI-R6F5-P3M4-62VM
Bulletin has no description...
MINI-6FR7-GHFQ-GMVM
Bulletin has no description...
MINI-FHG6-W67W-67H7
Bulletin has no description...
MINI-76MW-RG95-Q793
Bulletin has no description...
MAL-2026-16385 Malicious code in tlxbnhd (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e415dbf226269704c2cd28b1783cf594f96880dd4688b26caf7f25a19e268237 The tlxbnhd package ships obfuscated preinstall.js and postinstall.js lifecycle scripts that, on npm install, download two files from...
MAL-2026-16384 Malicious code in tldriver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16e29eeb8037e1166c10990a8e8f9424095dacc208961fd85775b1b14470995 The npm package [email protected] contains byte-identical scripts/preinstall.js and scripts/postinstall.js that are heavily obfuscated using...
MAL-2026-16383 Malicious code in mxdriver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f3ed1442f0588fda7bc378a0fe79c7170864472c6cca93b8ec6629645b1add0 The npm package [email protected] ships obfuscator.io-style string-array-obfuscated preinstall and postinstall scripts scripts/preinstall.js,...
GHSA-798P-78G2-V556 @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509
Summary The SSRF guard validateServerUrl added for CVE-2026-33060, extended for CVE-2026-53509 validates only the hostname string and never resolves DNS. Any caller-supplied serverurl whose hostname resolves to an internal address passes the guard, so the server issues requests to loopback and...
GHSA-29HQ-23M2-2J47 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)
Summary validateUser in backend/src/authentication/providers/mysql/auth-provider-mysql.service.ts returns immediately when the supplied login/email does not match any account, without ever calling comparePassword: async validateUserloginOrEmail: string, password: string, ip?: string, scope?:...
GHSA-JX63-H26R-8CPH Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`
Affected component: Sync-in Server v2.3.0, POST /api/app/sync/operation/diff/:id, vulnerable implementation of pathFilters in backend/src/applications/sync/dtos/sync-operations.dto.ts. Summary In the vulnerable version, the sync diff endpoint accepted a user-controlled regex pattern through...