Malicious Package

Overview devplatform-s3-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview gator-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-14970

The NIM server process in AIX 7.2/7.3 and PowerVM VIOS 4.1 crashes during client registration due to a buffer overflow, exploitable over the network with no authentication. CVSS 7.5 (HIGH) reflects high availability impact; no confidentiality or integrity impact is noted. IBM support page: https:...

CVE-2026-14970 Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM server process is crashing during client registration due to buffer overflow...

EUVD-2026-62516

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM server process is crashing during client registration due to buffer overflow...

CVE-2026-48711

SSHFS (a network filesystem client for SSH) is vulnerable to argument injection in its find_base_path() function. From version 1.4 through 3.7.5, a bracketed mount source such as [-oProxyCommand=CMD]:/path has its brackets stripped, leaving a host value beginning with - that is passed directly to...

aws-client (>=0.10.0, <=0.11.0), git-repo (>=1.7.0, <=1.7.1) potentially affected by CVE-2026-76222 via gitpython (2.0.6)

gitpython PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - aws-client =0.10.0, =1.7.0, =1.7.1 Source cves: CVE-2026-76222 Source advisory: OSV:PYSEC-2026-3784...

aws-client (>=0.10.0, <=0.11.0), git-repo (>=1.7.0, <=1.7.1) potentially affected by CVE-2026-76221 via gitpython (2.0.6)

gitpython PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - aws-client =0.10.0, =1.7.0, =1.7.1 Source cves: CVE-2026-76221 Source advisory: OSV:PYSEC-2026-3783...

libcurl: libcurl: Security feature bypass due to improper mTLS connection reuse

A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security mTLS settings, particularly those for client certificates, should have prevented such reuse...

CLSA-2026-1787141541 Fix CVE(s): CVE-2026-32327, CVE-2026-34501, CVE-2026-34502

SECURITY UPDATE: heap buffer overflow in the memcached client - debian/patches/CVE-2026-34502.patch: validate CRLF line termination and response lengths in memcache/aprmemcache.c - CVE-2026-34502 SECURITY UPDATE: heap buffer overflow in the redis client - debian/patches/CVE-2026-34501.patch: boun...

PYSEC-2026-3680 Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

Summary The ACME client used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs connects to an acmeurl, then issues requests to URLs that the ACME server returns in its directory/order/authorization/finalize responses - this is the classic ACME-client SSRF RFC 8555...

Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs

SummaryThe ACME client used to issue certificates from Let's Encrypt / Google Public CA / private ACME CAs connects to an acmeurl, then issues requests to URLs that the ACME server returns in its directory/order/authorization/finalize responses - this is the classic ACME-client SSRF RFC 8555...

layer-client (0.3.5), sapsan (>=0.1.1, <=0.2.7) potentially affected by CVE-2026-64849 via mlflow (1.11.0)

mlflow PYPI version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.5 - sapsan =0.1.1, =0.2.7 Source cves: CVE-2026-64849 Source advisory: OSV:PYSEC-2026-3687...

layer-client (0.3.6), odahu-flow-mlflow-runner (1.4.0rc1) potentially affected by CVE-2026-64849 via mlflow (1.12.0)

mlflow PYPI version 1.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - layer-client 0.3.6 - odahu-flow-mlflow-runner 1.4.0rc1 Source cves: CVE-2026-64849 Source advisory: OSV:PYSEC-2026-3687...

backwardcompatibilityml (>=1.4.0, <=1.4.2), layer-client (>=0.3.7b1, <=0.3.9) potentially affected by CVE-2026-64849 via mlflow (1.12.1)

mlflow PYPI version 1.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - backwardcompatibilityml =1.4.0, =0.3.7b1, =0.3.9 Source cves: CVE-2026-64849 Source advisory: OSV:PYSEC-2026-3687...

databricks-genai (>=1.1.0, <=2.0.0a9), llm-foundry (>=0.12.0, <=0.14.5) +5 more potentially affected by CVE-2026-64849 via mlflow (2.16.2)

mlflow PYPI version 2.16.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - databricks-genai =1.1.0, =0.12.0, =0.0.3.post33, =0.0.16, =0.9.35rc0, =0.8.7, =0.8.8 Source cves: CVE-2026-64849 Source advisory: OSV:PYSEC-2026-36...

bitwarden (>=0.2.2, <=0.4.0), bubble3 (>=2018.3.29, <=2018.6.4) +4 more potentially affected by CVE-2026-9318 via tablib (0.12.1)

tablib PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on tablib and may be impacted: - bitwarden =0.2.2, =2018.3.29, =0.0.1, =0.9.4, =0.0.1, =0.0.4 Source cves: CVE-2026-9318 Source advisory: OSV:PYSEC-2026-3702...

PYSEC-2026-3683 mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachment

Summary confluenceuploadattachment passes filepath directly to openfilepath, "rb" with no path validation. Any authenticated MCP client — or an AI agent manipulated via prompt injection — can read any file the server process can access and exfiltrate it to Confluence as an attachment. Details Roo...

Malicious code in log-res (npm)

Source: amazon-inspector 59f23ea1c6c40021fb69210eba68cdbda94b42f4e255f78758778b90ebb09d78 index.js re-exports a desKey string sourced from apps/docs/app/theta.js, which reads apps/docs/app/des.db as UTF-8. des.db contains a heavily obfuscated JavaScript program string-array + hex-name mangling...

Uncontrolled Resource Consumption

RabbitMQ Java client library is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to ValueReader.readBytes allocating a byte array based on a wire-declared content length before verifying the actual bytes available in the frame, which allows a malicious unauthenticated AMQ...