123095 matches found
MAL-2026-10574 Malicious code in vite-plugin-config-paths (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96c7307466b955fa9b453e949ec2fda3153e5c444b906eed5e3bc88d190a33a7 Package name impersonates the widely-used vite-plugin-tsconfig-paths the package.json homepage points to the legitimate plugin's README, and the READ...
Malicious code in vite-plugin-config-paths (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96c7307466b955fa9b453e949ec2fda3153e5c444b906eed5e3bc88d190a33a7 Package name impersonates the widely-used vite-plugin-tsconfig-paths the package.json homepage points to the legitimate plugin's README, and the READ...
CVE-2026-15628
creationtimestamp| type| source ---|---|--- 2026-07-14 05:52:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqljbsldb52l 2026-07-19 20:32:00+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqzmrci6j52u 2026-07-19 20:36:31+00:00| seen|...
CVE-2026-15624
creationtimestamp| type| source ---|---|--- 2026-07-14 05:44:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqlitd4niy2w 2026-07-19 20:37:59+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqzn3yzip42y...
CVE-2026-62393
creationtimestamp| type| source ---|---|--- 2026-07-14 04:40:28+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqlfb7cxfr2q 2026-07-21 08:50:49+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mr5gjcoqlw2h 2026-07-21 08:55:07+00:00| seen|...
Information Exposure
Overview Affected versions of this package are vulnerable to Information Exposure in the handleNavigate function of the file pkg/browser/tool.go when manipulating the args.targetUrl argument. An attacker can access sensitive information by sending crafted requests remotely. Remediation There is n...
CVE-2026-62392
creationtimestamp| type| source ---|---|--- 2026-07-14 04:20:27+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqle5fo5ev23 2026-07-15 03:07:08+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mqnqj744cc2n 2026-07-21 08:46:15+00:00| seen|...
CVE-2026-15668 louisho5 picobot web Tool web.go WebTool.Execute server-side request forgery
A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotel...
CVE-2026-15668
The CVE affects louisho5 picobot up to version 0.2.0, specifically the web Tool component. The vulnerability resides in WebTool.Execute (internal/agent/tools/web.go) where manipulation of the url argument enables server-side request forgery (SSRF). It is a network-vector, with low privileges requ...
CVE-2026-15668 louisho5 picobot web Tool web.go WebTool.Execute server-side request forgery
A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotel...
CVE-2026-53365
creationtimestamp| type| source ---|---|--- 2026-07-14 03:59:17+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqlcxkyn422e 2026-07-16 08:21:40+00:00| seen| https://bsky.app/profile/khesefxyz.bsky.social/post/3mqqskkz2gh2b 2026-08-14 21:43:30+00:00| seen|...
MAL-2026-10541 Malicious code in proxy-seller-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ae92b460e6db9195467e69567fadc3286877ea8e6b121448288a4f77acf5201 Package is published as proxy-seller-mcp with author: "Proxy-Seller" in package.json and a README directing users to obtain an API key at...
CVE-2026-15628
The CVE-2026-15628 affects zhayujie chatgpt-on-wechat CowAgent ≤ 2.1.1, specifically the Vision Tool’s Vision._download_to_data_url function. A manipulation of the image argument enables server-side request forgery, allowing remote initiation of attacks. Exploitation is supported by public disclo...
CVE-2026-44760
creationtimestamp| type| source ---|---|--- 2026-07-14 02:37:21+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mql6f2ks4726...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the webfetch function in the IPv4 Handler component when processing the url argument. An attacker can access internal resources, exfiltrate sensitive data, or perform unauthorized actions by supplyin...
Malicious code in chai-as-sets (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e62935357bb620be6ade887e298b5e5bbd6bff0b7a171a79f852d19c58142da4 The package name and description advertise a chai plugin, but the main entry point spawns a detached child process lib/initializeCaller.js when the...
MAL-2026-10519 Malicious code in chai-as-sets (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e62935357bb620be6ade887e298b5e5bbd6bff0b7a171a79f852d19c58142da4 The package name and description advertise a chai plugin, but the main entry point spawns a detached child process lib/initializeCaller.js when the...
CVE-2026-15624
A vulnerability has been found in nextlevelbuilder GoClaw 3.13.3-beta.3. Affected by this vulnerability is the function bytePlusDownloadVideo of the file internal/tools/createvideobyteplus.go of the component invoke Endpoint. The manipulation of the argument output.videourl leads to server-side...