nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw

A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. This occurs due to a technical issue with PFX object-array key collisions during connection reuse. As a result, a client's identity,...

Malicious code in @ai-agent-node/createnode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88461b4fe3bc4e6e16f6dbabec2dd4acdf4eb2df6390170776629e5f955f13f4 @ai-agent-node/createnode ships a 12-line main module that, on require, fetches https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 owner:...

Malicious code in @ai-agent-node/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9bd9860fa6b32249720b90f9ba4f48642cbd746fe04e701b05cba6eef2951671 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11173 Malicious code in @ai-agent-node/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9bd9860fa6b32249720b90f9ba4f48642cbd746fe04e701b05cba6eef2951671 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11171 Malicious code in @ai-agent-node/agent-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8edd22e8454df2a9c10d47ea5c39560f9384598e7fb2a26b26b8f647fd5d2dd1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11172 Malicious code in @ai-agent-node/createnode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88461b4fe3bc4e6e16f6dbabec2dd4acdf4eb2df6390170776629e5f955f13f4 @ai-agent-node/createnode ships a 12-line main module that, on require, fetches https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 owner:...

Malicious code in @ai-agent-node/agent-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8edd22e8454df2a9c10d47ea5c39560f9384598e7fb2a26b26b8f647fd5d2dd1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

burp-ai-agent v0.9.1

Custom AI Agent The bridge between Burp Suite and modern AI. A note on the name: This extension is published as Custom AI Agent formerly Burp AI Agent. It was renamed to comply with PortSwigger's BApp Store naming requirements and to avoid confusion with Burp Suite's built-in Burp AI provider. Th...

xalgorix v4.5.100

Xalgorix — Open-source AI pentester that proves vulnerabilities Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported — so you get proof, not a pile of maybes to triage...

CVE-2026-65975 Pydantic AI AG-UI Adapter: A dangling client-submitted tool call can execute when a trailing message is dropped during `sanitize_messages`

Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.88.0 up to but not including 1.107.1 and 2.0.0b1 up to but not including 2.5.0, the UI adapters AG-UI via Agent.toagui/AGUIAdapter, and Vercel AI via VercelAIAdapter use...

CVE-2026-18236

A vulnerability in the Agent Development Kit ADK allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework di...

EUVD-2026-50437

A vulnerability in the Agent Development Kit ADK allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework di...

CVE-2026-18236 Google-ADK Continuation Forgery

A vulnerability in the Agent Development Kit ADK allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework di...

CVE-2026-18236 Google-ADK Continuation Forgery

A vulnerability in the Agent Development Kit ADK allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework di...

CVE-2026-18236

Technical details are not publicly available in the provided documents. The ADK continuation forgery vulnerability description is repeated across sources without specifics on affected versions, exploit methods, or mitigations. Monitor for updates.

software.amazon.opentelemetry:aws-opentelemetry-agent (0.15.0-aws.1) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (0.15.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 0.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - software.amazon.opentelemetry:aws-opentelemetry-agent...

software.amazon.opentelemetry:aws-opentelemetry-agent (0.17.0-aws.1) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (0.17.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 0.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - software.amazon.opentelemetry:aws-opentelemetry-agent...

org.apache.inlong.agent-common.1.11.0.inlong1.11.org.apache.inlong:agent-common (1.11.0), org.apache.inlong:agent-common (>=1.9.0, <=2.4.0) +145 more potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.28.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.28.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: -...

org.hypertrace.agent:javaagent (>=1.1.0, <=1.1.6), software.amazon.opentelemetry:aws-opentelemetry-agent (1.1.0) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (1.1.0)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - org.hypertrace.agent:javaagent =1.1.0, =1.1.6 -...

software.amazon.opentelemetry:aws-opentelemetry-agent (0.12.1-aws.1) potentially affected by CVE-2026-54704 via io.opentelemetry.javaagent:opentelemetry-javaagent (0.12.1)

io.opentelemetry.javaagent:opentelemetry-javaagent MAVEN version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry.javaagent:opentelemetry-javaagent and may be impacted: - software.amazon.opentelemetry:aws-opentelemetry-agent...