MAL-2026-13767 Malicious code in sui-bcs-codec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11a215fced265f75473130d499c7d6ea6097f63aa19c595fc5445a56633b1c6e On require'sui-bcs-codec', a hidden IIFE labeled 'compat-probe' in index.js reads /.sui/sui.keystore, /.sui/suiconfig/.yaml, and.env files under cwd...

Malicious code in bs58-12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d59b2d561269e6779eed82e12abe726403e9a2419936c01a4deaea9c3e70b2c Package bs58-12 presents itself as the popular bs58 base58 library README copied from bs58, advertising npm i --save bs58 but its own code is a thin...

DEBIAN-CVE-2026-6726

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key such as an Attestation Key, DevID Key or TLS authentication key and falsify other TPM 2...

CVE-2026-6726

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key such as an Attestation Key, DevID Key or TLS authentication key and falsify other TPM 2...

CVE-2026-48495

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON state parameter and trusts the embedded workspaceId, typebotId, blockId, and redirectUrl without cryptographic integrity protection or authorization checks. The callback rout...

CVE-2026-48766

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled baseUrl. The vulnerable path decrypts the selected workspace...

CVE-2026-42142

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the handleGetSheets API handler POST /api/sheets/getSheets does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data...

Malicious code in dakumangalsingh_virus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5c32842af81f239247b0cb4980f29b20051e92fed5751d4c297ede4f5a9116d The tarball contains a 455 KB Windows PE64 executable named DakuMangalSingh.exe sha256 368320791e5c022ffabedb44eae6ca902fe3f524754a085b726617c2006dc7...

CVE-2026-48495 TypeBot Google Sheets OAuth callback can create credentials in unauthorized workspaces and modify arbitrary typebots

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON state parameter and trusts the embedded workspaceId, typebotId, blockId, and redirectUrl without cryptographic integrity protection or authorization checks. The callback rout...

CVE-2026-48495

CVE-2026-48495 affects TypeBot prior to v3.17.0: the Google Sheets OAuth callback decodes a base64-encoded JSON state and trusts embedded workspaceId, typebotId, blockId, and redirectUrl without cryptographic integrity or authorization checks. Although the callback route is authenticated, it does...

CVE-2026-48766 TypeBot vulnerable to OpenAI API key exfiltration in listModels via attacker-controlled baseUrl

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled baseUrl. The vulnerable path decrypts the selected workspace...

CVE-2026-48766 TypeBot vulnerable to OpenAI API key exfiltration in listModels via attacker-controlled baseUrl

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege guest member of a workspace to exfiltrate stored OpenAI-compatible API keys by invoking the OpenAI model-listing helper with an attacker-controlled baseUrl. The vulnerable path decrypts the selected workspace...

CVE-2026-48766

TypeBot (chatbot builder) before version 3.17.0 exposes OpenAI API keys stored in workspaces. A low-privilege guest can exfiltrate credentials by invoking the OpenAI model-listing helper with an attacker-controlled baseUrl. The vulnerability decrypts the workspace credential, constructs an OpenAI...

CVE-2026-42142

TypeBot (pre-3.17.0) exposes an authorization bypass in the GET/Sheets endpoint: POST /api/sheets/getSheets does not validate workspace membership, enabling any authenticated user to access and decrypt another workspace’s Google Sheets OAuth credentials and retrieve spreadsheet data (names, IDs, ...

CVE-2026-42142 TypeBot has Authorization Bypass in Google Sheets `getSheets` Endpoint that Allows Cross-Workspace Credential Access

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the handleGetSheets API handler POST /api/sheets/getSheets does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data...

EUVD-2026-56235

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the handleGetSheets API handler POST /api/sheets/getSheets does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data...

CVE-2026-42142 TypeBot has Authorization Bypass in Google Sheets `getSheets` Endpoint that Allows Cross-Workspace Credential Access

TypeBot is a chatbot builder tool. Prior to version 3.17.0, the handleGetSheets API handler POST /api/sheets/getSheets does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data...

CVE-2026-16336

A flaw was found in Trino's OAuth2/OIDC component. A remote attacker can exploit this vulnerability by manipulating the redirecturi argument, leading to an open redirect. This could allow an attacker to redirect users to malicious websites, potentially enabling phishing attacks or credential thef...

CVE-2026-6726

An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key such as an Attestation Key, DevID Key or TLS authentication key and falsify other TPM 2...

CVE-2026-6726

The CVE concerns the TPM 2.0 reference code from the TCG. Affected component: TPM 2.0 reference implementation. Root cause/attack vector: information leakage could allow a local attacker with elevated privileges to obtain a credential from a TPM‑aware certificate authority for a falsified TPM key...