2120892 matches found
MAL-2026-17305 Malicious code in esm-dotenv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55c5c67c48596e011158554f8b5ea57d65a8a8dc3b5f4120d3c9c4d1cf961da2 The package advertises itself as a zero-dependency dotenv parser but its main entry dist/index.cjs and CLI bin dist/cli.cjs both invoke...
MAL-2026-17304 Malicious code in dotenv-precheck (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 446a8483dbc9e696506f44c6777b7c086b1b919b2585b5e5c99ca5f6e2e19a8e [email protected] is a credential-stealing package disguised as a dotenv preflight utility. package.json wires index.js as a postinstall script, ...
CLEANSTART-2026-WG16453 source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2...
CVE-2026-56854 affects multiple packages. The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. See references for individual vulnerability...
CLEANSTART-2026-LW45744 Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello
Security vulnerability affects the minio-operator package. Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello...
GHSA-QHR7-859C-M2P7 brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
Summary expand recurses once per level of brace nesting. Deeply nested input exhausts the native stack and crashes the process. This is distinct from CVE-2026-14257 / GHSA-mh99-v99m-4gvg, which made the tail iterative recursion on m.post, driven by how many groups are chained. Nesting depth drive...
GHSA-9V7F-9G4P-FFGJ PyJWT: PyJWKClient follows redirects when fetching JWKS
Summary PyJWT 2.13.0 PyJWKClient followed HTTP redirects while fetching a JWKS, without validating the redirect destination. A configured trusted endpoint could therefore redirect the client to a different host. Impact When an application uses PyJWKClient with caller-supplied request headers and ...
GHSA-8238-W5PM-2374 adm-zip: Unhandled error event in async DEFLATE decompression crashes Node.js process (DoS)
Summary Denial of Service in adm-zip's async decompression API allows an unauthenticated attacker to crash the entire Node.js host process by supplying a single malformed ZIP file. Details Affected package: adm-zip Affected versions: at least 0.6.0 current latest; likely all versions containing t...
GHSA-M6MH-2HW2-555X Ammonia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The following SVG will produce a link with a javascript scheme. If the user clicks this link, they will run it. svg Click set Impact Allows stored XSS in applications that allow the animate and set tags. Patches Fixed in 3.3.3, 4.0.3, and 4.1.4 Workarounds Do not enable the animate or set tags...
MAL-2026-17289 Malicious code in @rutxploit-sec/subsplash-google-tag-manager (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fe2c746dc5c09bc67257fd4eba671824806c9080b7ca94949e45175deb03b8d package.json declares a preinstall script that executes inline Node code reading os.hostname and os.userInfo.username and issuing an HTTP GET to...
MINI-F274-7Q5C-QPCX
Bulletin has no description...
MINI-M675-P2PH-Q3JQ
Bulletin has no description...
MINI-777R-FR8X-WJFJ
Bulletin has no description...
MINI-6C6X-57Q6-PF23
Bulletin has no description...
MINI-M4X9-WJC8-F448
Bulletin has no description...
MINI-85WW-5RWW-HX3F
Bulletin has no description...
MINI-5H6W-HQ2R-JH6P
Bulletin has no description...
MINI-FHC8-MW3R-VQPP
Bulletin has no description...
MINI-GQ3J-FR44-P448
Bulletin has no description...
MINI-86XM-M827-4PQJ
Bulletin has no description...
MINI-X2HP-VCQW-55HV
Bulletin has no description...
MAL-2026-17285 Malicious code in @akapaki/baileys (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c14fdf44df68d2544cc235039ef40a99c7df7bcbfc968e8d5809762031f0dd16 @akapaki/[email protected] is an unofficial republish of the Baileys WhatsApp library under a new scope author paki, empty README, repository...
MINI-C9Q6-MGHV-5QJ2
Bulletin has no description...
MINI-QXV4-XXV4-M2HH
Bulletin has no description...
MINI-RG33-RQ85-R7X6
Bulletin has no description...
MINI-GV9G-43PF-XH2R
Bulletin has no description...
MINI-96R5-5MWV-6GVP
Bulletin has no description...
MINI-RJGM-Q4FQ-HRPM
Bulletin has no description...
MINI-38H7-RFVQ-4QHV
Bulletin has no description...
MINI-QPFM-4HPH-8V6R
Bulletin has no description...
MINI-9GRR-2VG5-72HF
Bulletin has no description...
MINI-Q4C3-VWHH-93G2
Bulletin has no description...
MINI-8PPH-HJ2W-529X
Bulletin has no description...
MINI-Q29P-RWQJ-C674
Bulletin has no description...
MINI-3V72-CJGF-RV23
Bulletin has no description...
MINI-HW67-H52G-PVQM
Bulletin has no description...
MINI-MFX2-MHH2-2GMQ
Bulletin has no description...
MINI-M4VX-WP6R-2WR6
Bulletin has no description...
MINI-W3JW-FV8F-QC99
Bulletin has no description...
MINI-GFC6-9XGR-536G
Bulletin has no description...
MINI-X4X2-4VR3-7MG9
Bulletin has no description...
MINI-P5W3-2H3G-2GCX
Bulletin has no description...
MINI-WRV8-8H68-JQCH
Bulletin has no description...
MINI-X9WM-45Q9-XJWW
Bulletin has no description...
MINI-8FGF-8HM7-526M
Bulletin has no description...
MINI-RWG5-53Q7-3RG7
Bulletin has no description...
MINI-2956-7M32-FRR2
Bulletin has no description...
MINI-JR5F-Q5FW-JHGW
Bulletin has no description...
MINI-QP2Q-7WJ7-X4MF
Bulletin has no description...