2099493 matches found
MAL-2026-16387 Malicious code in @mr-supun-fernando/supunmd-bail (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86c68c82f6ead4ab3b823b81fd6805991bfdd65cdc901d83aeb561cdd8f27b19 package.json declares "libsignal": "github:tenka-san/libsignal-node" — an off-registry dependency source pointing at a personal-user GitHub repositor...
ROOT-APP-GOBINARY-CVE-2026-77412 CVE-2026-77412 in github.com/rabbitmq/amqp091-go - Patched by Root
Root has patched CVE-2026-77412 in the github.com/rabbitmq/amqp091-go package for Root:Go. Multiple fixed versions available...
MINI-X2FW-MG2C-2H55
Bulletin has no description...
MINI-35CJ-MQQG-H6RQ
Bulletin has no description...
MINI-99P2-FGXQ-96VP
Bulletin has no description...
MINI-8G49-32PJ-X475
Bulletin has no description...
MINI-CR3J-MFPG-X64R
Bulletin has no description...
ROOT-APP-MAVEN-AIKIDO-2024-10351 AIKIDO-2024-10351 in org.springframework:spring-webmvc - Patched by Root
Root has patched AIKIDO-2024-10351 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-41842 CVE-2026-41842 in org.springframework:spring-webmvc - Patched by Root
Root has patched CVE-2026-41842 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2024-38819 CVE-2024-38819 in org.springframework:spring-webmvc - Patched by Root
Root has patched CVE-2024-38819 in the org.springframework:spring-webmvc package for Root:Maven. Multiple fixed versions available...
MINI-8WGQ-6C7F-G8GF
Bulletin has no description...
MINI-2285-5HVM-QMGH
Bulletin has no description...
MINI-PC43-6F3V-XMVP
Bulletin has no description...
MINI-M9GC-XV7X-7VJJ
Bulletin has no description...
MINI-2835-27MM-RG7P
Bulletin has no description...
MINI-FFGX-X932-F3VV
Bulletin has no description...
MINI-96WF-W55V-575J
Bulletin has no description...
MINI-985X-728W-W44C
Bulletin has no description...
MINI-6V6R-FCCC-JXM3
Bulletin has no description...
MINI-G2Q3-3GCM-XQ57
Bulletin has no description...
MINI-4RC7-8H2R-JC3C
Bulletin has no description...
MAL-2026-16385 Malicious code in tlxbnhd (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e415dbf226269704c2cd28b1783cf594f96880dd4688b26caf7f25a19e268237 The tlxbnhd package ships obfuscated preinstall.js and postinstall.js lifecycle scripts that, on npm install, download two files from...
MAL-2026-16384 Malicious code in tldriver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16e29eeb8037e1166c10990a8e8f9424095dacc208961fd85775b1b14470995 The npm package [email protected] contains byte-identical scripts/preinstall.js and scripts/postinstall.js that are heavily obfuscated using...
MAL-2026-16383 Malicious code in mxdriver (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f3ed1442f0588fda7bc378a0fe79c7170864472c6cca93b8ec6629645b1add0 The npm package [email protected] ships obfuscator.io-style string-array-obfuscated preinstall and postinstall scripts scripts/preinstall.js,...
GHSA-29HQ-23M2-2J47 Sync-in Server has Username/Login Enumeration via Timing Side-Channel on POST /api/auth/login (incomplete fix of the prior timing-attack advisory)
Summary validateUser in backend/src/authentication/providers/mysql/auth-provider-mysql.service.ts returns immediately when the supplied login/email does not match any account, without ever calling comparePassword: async validateUserloginOrEmail: string, password: string, ip?: string, scope?:...
GHSA-JX63-H26R-8CPH Sync-in Server has a ReDoS via Unsanitized Regex in Sync Diff `pathFilters`
Affected component: Sync-in Server v2.3.0, POST /api/app/sync/operation/diff/:id, vulnerable implementation of pathFilters in backend/src/applications/sync/dtos/sync-operations.dto.ts. Summary In the vulnerable version, the sync diff endpoint accepted a user-controlled regex pattern through...
DEBIAN-CVE-2026-92162
Bulletin has no description...
GHSA-92CR-JXW4-5WJG Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`
Affected component: Sync-in Server v2.3.0, POST /api/auth/token auth.controller.ts:50-55. Required attacker capability: Valid username and password for a 2FA-enabled account. Summary POST /api/auth/token authenticates with username and password only, then calls getTokens, which returns unrestrict...
GHSA-274F-6W77-8QM9 @sync-in/server vulnerable to TOTP Brute-Force via `POST /api/app/sync/register`
Affected component: Sync-in Server v2.3.0, POST /api/app/sync/register. Required attacker capability: Valid login and password for a TOTP-enabled account with desktop sync permission. Summary POST /api/app/sync/register accepts credentials and a TOTP code to register a desktop sync client. In the...
MAL-2026-16378 Malicious code in @tesla-insurance/vinless-quote (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4eebad2e44558080fee7f934edca91a78944985dae167e603557eb3144d43730 The package declares an install lifecycle script node index.js that loads runtime/support/telemetry/probe/impl.js. On npm install, this probe collect...
MAL-2026-16382 Malicious code in take-home-caller-id (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1adcf7c4b091ee35e021af3f4f886f5c8cc6f34b255315ab9767c3fdda5dcfe package.json declares a preinstall hook that runs index.js on npm install. index.js collects host identifiers via os.hostname and os.userInfo, reads...
MAL-2026-16381 Malicious code in cisco-github-simple (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2281890525d50138fab3030e71561f01f898fe9b97d56d2a894f1abf30632205 The package declares a preinstall lifecycle hook node index.js that runs automatically on npm install. index.js collects host reconnaissance from the...
CGA-M742-4P9J-3F58
Bulletin has no description...
CGA-PFGM-C8F6-9MX9
Bulletin has no description...
CGA-C625-M53R-H8Q8
Bulletin has no description...
CGA-G8VH-RX45-XH32
Bulletin has no description...
ROOT-APP-MAVEN-CVE-2021-33813 CVE-2021-33813 in org.jdom:jdom2 - Patched by Root
Root has patched CVE-2021-33813 in the org.jdom:jdom2 package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2024-29857 CVE-2024-29857 in org.bouncycastle:bcprov-jdk18on - Patched by Root
Root has patched CVE-2024-29857 in the org.bouncycastle:bcprov-jdk18on package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2025-8885 CVE-2025-8885 in org.bouncycastle:bc-fips - Patched by Root
Root has patched CVE-2025-8885 in the org.bouncycastle:bc-fips package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-13506 CVE-2026-13506 in org.bouncycastle:bc-fips - Patched by Root
Root has patched CVE-2026-13506 in the org.bouncycastle:bc-fips package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-13505 CVE-2026-13505 in org.bouncycastle:bc-fips - Patched by Root
Root has patched CVE-2026-13505 in the org.bouncycastle:bc-fips package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2026-8763 CVE-2026-8763 in org.bouncycastle:bc-fips - Patched by Root
Root has patched CVE-2026-8763 in the org.bouncycastle:bc-fips package for Root:Maven. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-6V7P-G79W-8964 GHSA-6v7p-g79w-8964 in msgpack - Patched by Root
Root has patched GHSA-6v7p-g79w-8964 in the msgpack package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2023-1370 CVE-2023-1370 in net.minidev:json-smart - Patched by Root
Root has patched CVE-2023-1370 in the net.minidev:json-smart package for Root:Maven. Multiple fixed versions available...
CGA-C3R7-RCC9-M2XP
Bulletin has no description...
CGA-34F9-HXMR-VH94
Bulletin has no description...
CGA-QR2H-87F2-V55P
Bulletin has no description...
ROOT-APP-NPM-GHSA-F88M-G3JW-G9CJ GHSA-f88m-g3jw-g9cj in sharp - Patched by Root
Root has patched GHSA-f88m-g3jw-g9cj in the sharp package for Root:npm. Multiple fixed versions available...