nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw

A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...

MAL-2026-11172 Malicious code in @ai-agent-node/createnode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88461b4fe3bc4e6e16f6dbabec2dd4acdf4eb2df6390170776629e5f955f13f4 @ai-agent-node/createnode ships a 12-line main module that, on require, fetches https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 owner:...

Malicious code in @ai-agent-node/createnode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88461b4fe3bc4e6e16f6dbabec2dd4acdf4eb2df6390170776629e5f955f13f4 @ai-agent-node/createnode ships a 12-line main module that, on require, fetches https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 owner:...

CVE-2026-65975 Pydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute when a trailing message is dropped during `sanitize_messages`

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0.0b1 up to but not including 2.5.0, the UI adapters AG-UI via Agent.toagui/AGUIAdapter, and Vercel AI via VercelAIAdapter use...

CVE-2026-18236

A vulnerability in the Agent Development Kit ADK allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework di...

CVE-2026-18236 Google-ADK Continuation Forgery

A vulnerability in the Agent Development Kit ADK allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework di...

CVE-2026-18236

Technical details are not publicly available in the provided documents. The ADK continuation forgery vulnerability description is repeated across sources without specifics on affected versions, exploit methods, or mitigations. Monitor for updates.

EUVD-2026-35187

AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping...

Cisco Advance Notification for Publication of August 5, 2026, Security Advisories

On August 5, 2026, the Cisco Product Security Incident Response Team PSIRT published the following advisories: Cisco Security Advisory CVE ID Security Impact Rating CVSS Base Score Cisco Catalyst SD-WAN Software Security Hardening Release: August 2026...

OpenAI Agent Used Exposed Credentials Across Four Services During Hugging Face Breach

OpenAI on Tuesday revealed the rogue artificial intelligence AI agent that escaped its sealed evaluation environment and broke into Hugging Face's production environment also hacked multiple third-party accounts and services as part of the attack. The latest disclosure shows that the security...

OPENSUSE-SU-2026:21476-1 Security update for google-guest-agent

This update for google-guest-agent fixes the following issues: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of inp...

MAL-2026-11499 Malicious code in @types-beta/sdk (npm)

The npm package @types-beta/sdk is a supply-chain dropper that impersonates the trusted @types DefinitelyTyped namespace to look like a routine type-definition dependency. It bundles a Windows executable vendor/nanocache.exe and launches it as an import-time side effect: dist/index.js calls init ...

ThreatForest: Multi-Agent Attack Tree Generation with Pluggable TTP Framework Mapping

Threat modeling is essential for secure software development, yet manual analysis of cloud-native architectures is slow and demands scarce security expertise. We present ThreatForest, a multi-agent system that generates structured attack trees from source code repositories, maps attack steps to...

CVE-2026-14893 IBM Instana Observability is affected by multiple Prototype Pollution within Instana Agent container image

IBM Observability with Instana Agent Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core version 6.2.1 is vulnerable to prototype pollution through its configuration normalization API...

CVE-2026-14893

The CVE is applicable to IBM Observability with Instana (Agent). The vulnerable component is the Node.js tracer, package @instana/core version 6.2.1, within IBM Instana Agent builds 1.0.303 through 1.0.320. The root cause is a prototype pollution flaw in the configuration normalization API, enabl...

GHSA-259R-337F-4RFW vulnerabilities

Vulnerabilities for packages: nerdctl, cert-manager, reports-server, elastic-agent-fips, prometheus-mongodb-exporter, cilium, k3d, terraform, kyverno, telegraf, spire-server, snyk-cli, prometheus, backup-restore-operator, flux, kots, kaf, containerd, kine, prometheus-operator, zot, k3s, minio,...

MAL-2026-11123 Malicious code in @yancyyu/agentcli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10b67ca39014513878a16bd2459cd4f1e6ebf24934aa5784df51b9acc766f264 The package extracts the AES-256-GCM master key for a separate product lark-cli from the macOS Keychain via security find-generic-password -s lark-cl...

Malicious code in @yancyyu/agentcli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10b67ca39014513878a16bd2459cd4f1e6ebf24934aa5784df51b9acc766f264 The package extracts the AES-256-GCM master key for a separate product lark-cli from the macOS Keychain via security find-generic-password -s lark-cl...

CVE-2026-66138

A vulnerability was found in Ironic-Python-Agent's IPA time syncing code. The value of the ntpserver configuration option is inserted into a shell command without sanitization. This command is run as root very early in the IPA startup flow, allowing an attacker to run arbitrary commands as root...

OPENSUSE-SU-2026:21456-1 Security update for google-osconfig-agent

This update for google-osconfig-agent fixes the following issues: - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation bsc1266603. - CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of...