MAL-2026-12165 Malicious code in bigops-external-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16bd7f21dc6d78b406fc39906d8cbb621072c638f84593871016f3b5ba5bae5 On require'bigops-external-auth', index.js loads adapter.js which downloads a platform-specific native binary from Cloudflare Worker hosts whose...

Malicious code in bigops-external-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c16bd7f21dc6d78b406fc39906d8cbb621072c638f84593871016f3b5ba5bae5 On require'bigops-external-auth', index.js loads adapter.js which downloads a platform-specific native binary from Cloudflare Worker hosts whose...

Malicious code in @zzzgenesis00/hd-key-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d1bce1ae0778169c4e5fb37721dfcc052c984efc60a257166adb4d20e2d39e5 @zzzgenesis00/hd-key-generator ships a postinstall.js that runs automatically on npm install. It enumerates /.ssh, /.npmrc, /.gitconfig, browser...

CVE-2026-71215 art-template - Path Traversal in Sub-Template Resolution via include()/extend()

art-template's sub-template resolution logic src/compile/adapter/resolve-filename.js, used by both the include and extend template directives, resolves the target file path via path.resolveroot, filename with no check afterward that the result remains inside root...

CVE-2026-55747 PocketFlow - Path Traversal in pocketflow-coding-agent Cookbook Example File Tools

The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.joinworkdir, p wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Severity reflects that this...

CVE-2020-6466

creationtimestamp| type| source ---|---|--- 2026-08-05 05:00:06+00:00| seen| https://t.me/timcorehacking/890 2026-08-06 00:00:53+00:00| seen| https://t.me/timcorehacking/890...

Malicious code in @zzzgenesis00/bip39-mnemonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f370f7bfdab3817c323daee33d8de48e5171c41dad3f1bff2f1335e04a65060 Package impersonates the bitcoinjs/bip39 project author field set to 'bitcoinjs-lib' and ships a postinstall.js that runs on npm install. The script...

PT-2026-68132

Name of the Vulnerable Software and Affected Versions ESPHome versions prior to 2026.7.0-dev Description An operator-precedence bug exists in the cv.url validator within esphome/config validation.py. Due to the and operator binding tighter than or, any file: URI passes validation regardless of th...

XXE vulnerability in ivy-report

ivy-report 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control workspace contents to have Jenkins parse a crafted Ivy report XML file that uses external entities for extraction of secrets from the Jenkins controller o...

Missing permission check in external-workspace-manager allows reading workspace files

external-workspace-manager 1.4.1 and earlier does not perform a permission check 1.4.0 and earlier or performs an improper permission check 1.4.1 when providing access to externally-managed workspaces through the workspace browser. This allows attackers with Overall/Read permission to read files ...

PT-2026-68187

Name of the Vulnerable Software and Affected Versions Apache Answer versions prior to 2.0.2 Description Insufficient Verification of Data Authenticity in the external-login email binding flow. A missing authorization check allows unauthenticated attackers to take over arbitrary user accounts by...

PT-2026-68271

Name of the Vulnerable Software and Affected Versions Jenkins External Workspace Manager Plugin versions prior to 1.4.2 Description The workspace browser fails to properly validate permissions when granting access to externally-managed workspaces. This allows users with Overall/Read permissions t...

CVE-2026-70448: Improper Restriction of XML External Entity Reference

Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks when processing Ivy report files...

CVE-2026-70436: Missing Authorization

Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check 1.4.0 and earlier or performs an improper permission check 1.4.1 when providing access to externally-managed workspaces through the workspace browser, allowing attackers with Overall/Read permission to...

CVE-2026-10025: Improper Restriction of XML External Entity Reference

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity XXE injection vulnerability. The vulnerability resides in the parseXmlPayload function within the event processing pipeline q1labscore.jar . When at least one log source type is configured...

PT-2026-68288

Name of the Vulnerable Software and Affected Versions Electron versions prior to 39.8.8 Electron versions prior to 40.9.0 Electron versions prior to 41.2.1 Electron versions prior to 42.0.0-beta.3 Description Requests to open external protocol URLs from web content do not respect iframe sandbox...

CVE-2026-48911: Missing Authentication for Critical Function

Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into...

Jenkins plugins Multiple Vulnerabilities (2026-08-05)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2... CVE-2026-70426 - Jenkins 2.575 and...

Malicious code in @zzzgenesis00/web3-provider-engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fae571005ccdcdc23e50fbee1eddc31d39355706b7945df3ccbb3096ecaf724b Package impersonates MetaMask's web3-provider-engine author field 'MetaMask', homepage pointing to github.com/MetaMask/web3-provider-engine while...

Malicious code in @zzzgenesis00/crypto-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0059f996b08ee001bad27a2ec933573651b171f5b4fcde2b1e12b7a4388c7ca3 postinstall.js runs automatically on npm install and enumerates installer-owned secret material: SSH private keys under /.ssh, /.npmrc, /.gitconfig,...