https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-02T23:30:46.245313+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/brew-pnpm-cve-2026-55487 BREW-pnpm-CVE-2026-55487 — pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle 2026-10-02T23:30:46.248328+00:00

Affected: Homebrew: pnpm

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stripped parenthesized text from git, URL, tarball, file, and other opaque locators. Approval for one source string could therefore authorize a different attacker-controlled source whose locator normalized to the same value. This vulnerability is fixed in 10.34.2 and 11.5.3.

 https://db.gcve.eu/vuln/cve-2026-55487 CVE-2026-55487 — pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle 2026-10-02T23:30:46.248422+00:00

Affected: pnpm

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, the generic peer-suffix normalizer also stripped parenthesized text from git, URL, tarball, file, and other opaque locators. Approval for one source string could therefore authorize a different attacker-controlled source whose locator normalized to the same value. This vulnerability is fixed in 10.34.2 and 11.5.3.