CVE-2026-53509: Server-Side Request Forgery (SSRF)

CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckanpackagesearch and sparqlquery that accept a baseurl parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to...

Malicious Package

Overview vite-common-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in ai-texts-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a340348046b89bf8c446a31a4f48233ec4e0bc412f531db713f54f35c6ea922c [email protected] declares a single runtime dependency, 'ai-texts', shipped as a bundledDependency inside the tarball. That bundled module present...

MAL-2026-14302 Malicious code in ai-texts-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a340348046b89bf8c446a31a4f48233ec4e0bc412f531db713f54f35c6ea922c [email protected] declares a single runtime dependency, 'ai-texts', shipped as a bundledDependency inside the tarball. That bundled module present...

MAL-2026-14313 Malicious code in node-runtime-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cac7a39a8896a7f78a20fe79758f146d2158f2fc529e51ac705720a745552770 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious Package

Overview ai-texts-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview node-runtime-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview fe-utils-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview nice-utils-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview agora402-payment-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

CLSA-2026-1787115093 TuxCare security update for org.codehaus.plexus:plexus-utils (1 CVE)

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 3.0.20-tuxcare.1...

MAL-2026-14248 Malicious code in nice-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c88734e4d701b61fd197a942bc057f59c684d4eb9994ca0efc7136dfcf893c9 The npm package [email protected] executes probe.js from its postinstall lifecycle. On install, probe.js issues requests to cloud...

PT-2026-83420

TuxCare rebuilt org.codehaus.plexus:plexus-utils to address 1 CVE. Fixed in 3.0.20-tuxcare.1...

CVE-2026-55085: Improper Neutralization of Input During Web Page Generation

Etherpad is a real-time collaborative editor. Prior to 3.3.1, result.appendSpan in src/static/js/domline.ts interpolates the start attribute of a numbered list directly into an unquoted ol start attribute before assigning the generated markup to node.innerHTML. ImportEtherpad.setPadRaw in...

CVE-2026-55090: Improper Neutralization of Input During Web Page Generation

Etherpad is a real-time collaborative editor. Prior to 3.3.0, getHTMLFromAtext in src/node/utils/ExportHtml.ts interpolates values from the exportHtmlAdditionalTagsWithData plugin hook into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value...

Malicious code in agora402-payment-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f The package advertises itself as a payment utility library, but its public API validateRecipient, routePayment, processPayment discards the...

MAL-2026-14136 Malicious code in agora402-payment-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3c7a0b2d80c3876cf42a18bbe6b9f74b728270a70953007cdcfb46ee89453a3f The package advertises itself as a payment utility library, but its public API validateRecipient, routePayment, processPayment discards the...

CVE-2026-70681

Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite component: JRI and other Java utils. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

GO-2026-6127 Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory in github.com/fission/fission

Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory in github.com/fission/fission...

Amazon Linux 2 : iscsi-initiator-utils, --advisory ALAS2-2026-3867 (ALAS-2026-3867)

The version of iscsi-initiator-utils installed on the remote host is prior to 6.2.0.874-7. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3867 advisory. An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open-...