MAL-2026-10361 Malicious code in omglucidesotuff (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d144d98f0e90909ee371acfeeec0ad2ffe44450335ddf7f7a58f71a53dc7b107 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10286 Malicious code in backup2-asd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6fe96add7d70ce5933988f1c78b934187e279d88618bd3f211de3d719177168 The tarball published as [email protected] is a Vite-built browser application branded 'Lucide' rather than a Node library. package.json declares mai...

MAL-2026-10299 Malicious code in crazynut (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99acc5fd6f39abd90d81467df8fe55d92230edd286a12d9f628ad6f9c1c34a9a The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10290 Malicious code in backupgenuine-updated (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 163e55285112106141566338db7483490b20567a431458b4b921a71534135ce0 Package published as [email protected] with description "Republished package" actually contains a Vite-built single-page application titled...

Malicious code in @gt-test-exp/profiler-exp-00000002 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1dc5884175c7dc809c1bbc5ffa179fb86fb84e07903ca747d62692257a7972fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dogfood-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee9ec99742993d16c0c4ef9257240a9841f876da2940bcfb6ceb77b0e51a02cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10300 Malicious code in dogfood-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee9ec99742993d16c0c4ef9257240a9841f876da2940bcfb6ceb77b0e51a02cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gpapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8adfa222041807cea6aa53e26cca9c0eba0922efbb9afd0d201d90a3ba201165 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @iana-rzms/bff-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7adbad0c719aec3345c5aa16b3435e8621f4a81b5a0e0cf0e0d979509e5d21f Package published to the public @iana-rzms scope as a dependency-confusion squat targeting an internal ICANN namespace. The preinstall lifecycle scri...

MAL-2026-10403 Malicious code in @iana-rzms/bff-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7adbad0c719aec3345c5aa16b3435e8621f4a81b5a0e0cf0e0d979509e5d21f Package published to the public @iana-rzms scope as a dependency-confusion squat targeting an internal ICANN namespace. The preinstall lifecycle scri...

MAL-2026-10401 Malicious code in @espn-ping/react-dmed-oauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc0467ac62043cf22dd249a99ff1279646dc599702140998ff5b86c79645364 @espn-ping/[email protected] declares a preinstall lifecycle script node index.js /dev/null 2&1 that automatically executes on npm install...

CVE-2026-15521

creationtimestamp| type| source ---|---|--- 2026-07-13 02:28:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqinfvtqii2f 2026-07-13 03:58:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqishukvj72t...

PT-2026-58934

Description The push-subscription endpoint stores an attacker-controlled delivery URL, and the notification send path becomes an outbound-request sink when VAPID delivery is enabled. The practical result is an authenticated, stored, mostly blind SSRF primitive to arbitrary HTTPS endpoints reachab...

PT-2026-59609

Summary A Server-Side Request Forgery SSRF vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially...

PT-2026-60040

xiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in the GET /music/file path:path endpoint that allows unauthenticated attackers to read arbitrary files outside the intended music directory by exploiting an incomplete path prefix check. Attackers can request files from...

PT-2026-59059

Summary Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A...

PT-2026-57846

Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact...

PT-2026-59536

The PraisonAI templates installation feature is vulnerable to a "Zip Slip" Arbitrary File Write attack. When downloading and extracting template archives from external sources e.g., GitHub, the application uses Python's zipfile.extractall without verifying if the files within the archive resolve...

PT-2026-59088

An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3. Arbitrary file access can occur via custom QCOW2 external data. By supplying a crafted QCOW2 image that references a specific data file path, an authenticated user may convince systems to...

PT-2026-59021

aiograpi versions before 0.9.10 accepted server-supplied signup challenge paths and used them to build request URLs before validating that the paths were relative Instagram API paths. A malicious or tampered challenge payload could cause challenge handling requests to be sent outside the intended...