MAL-2026-3180 Malicious code in nicegui (npm)

Malicious npm package published by threat actor "ryanmccollum1" typosquatting the popular Python NiceGUI framework. Part of the same supply chain attack campaign as redeem-onchain-sdk, which collects SSH keys, AWS credentials, .npmrc tokens, Docker auth, Chrome saved logins, .env files, and git...

Malicious code in redeem-onchain-sdk (npm)

redeem-onchain-sdk is a malicious npm package impersonating a Polymarket on-chain SDK. It collects SSH keys, AWS credentials, .npmrc tokens, Docker auth, Chrome saved logins, .env files, and a month of git commit history, then ships everything over a raw TCP socket to an AWS-hosted C2. Two trigge...

Malicious code in period-newline (npm)

Malicious npm package published by threat actor "ryanmccollum1" impersonating a benign text-formatting utility. Part of the same supply chain attack campaign as redeem-onchain-sdk, which collects SSH keys, AWS credentials, .npmrc tokens, Docker auth, Chrome saved logins, .env files, and git...

Malicious code in apple-internal-auth-v3 (npm)

Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Apple internal infrastructure services authentication, PKI, telemetry, CloudKit, and cloud infrastructure. All packages in this campaign execute credential-theft payloads durin...

MAL-2026-3152 Malicious code in apple-coredata-internal-service (npm)

Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Apple internal infrastructure services authentication, PKI, telemetry, CloudKit, and cloud infrastructure. All packages in this campaign execute credential-theft payloads durin...

CVE-2026-7191

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Conten...

CVE-2026-7191 Arbitrary Code Execution via Sandbox Bypass in the open source solution QnABot on AWS

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Conten...

EUVD-2026-25921

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Conten...

PT-2026-35526

Name of the Vulnerable Software and Affected Versions qnabot-on-aws versions prior to 7.3.0 Description Improper use of the static-eval npm package allows an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context. This is achieved by injecting a...

CVE-2026-41485 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno...

GHSA-CVQ5-HHX3-F99P vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno...

GHSA-QR4G-8HRP-C4RW vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno...

GHSA-QR4G-8HRP-C4RW vulnerabilities

Vulnerabilities for packages: kyverno, kyverno-fips, kyverno-notation-aws, kyverno-notation-aws-fips...

GHSA-CVQ5-HHX3-F99P vulnerabilities

Vulnerabilities for packages: kyverno, kyverno-fips, kyverno-notation-aws, kyverno-notation-aws-fips...

CVE-2026-41485 vulnerabilities

Vulnerabilities for packages: kyverno, kyverno-fips, kyverno-notation-aws, kyverno-notation-aws-fips...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-driver-nfs-fips, crossplane-provider-gitlab-fips, gatekeeper, kubevirt-cdi-controller, flux-image-reflector-controller-fips, consul-fips, crossplane-provider-azure-resources, kro, neuvector, fleet-server, eksctl, datadog-agent-fips, knative-kafka-broke...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: minio, cert-manager, rancher, yunikorn-k8shim, cert-manager-istio-csr, gitlab-runner, flux, opentofu, harbor, dex, openbao, spqr, percona-server-mongodb-operator, telegraf, kyverno, cert-manager-csi-driver, seaweedfs, cert-manager-cmctl, juicefs, teleport, ratify,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: minio, cert-manager, rancher, yunikorn-k8shim, cert-manager-istio-csr, gitlab-runner, flux, opentofu, harbor, dex, openbao, spqr, percona-server-mongodb-operator, telegraf, kyverno, cert-manager-csi-driver, seaweedfs, cert-manager-cmctl, juicefs, teleport, ratify,...

CVE-2026-6911

Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the application, including the ability to read, modify, and delete all application data across tenants and manage Cognito user accounts within the...

CVE-2026-6911 Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel

Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the application, including the ability to read, modify, and delete all application data across tenants and manage Cognito user accounts within the...