Malicious code in @xiaohhhh1/canvas-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a34add291ef7584aec7041449cb2e80d36ae98f93c2725e1aa018707e3334119 On bin start, @xiaohhhh1/canvas-agent opens an outbound WebSocket to the hardcoded relay wss://canvas.xiaohhhh1.com/api/agent-relay and treats inboun...

github.com/moby/buildkit: BuildKit: Information Disclosure via Improper Handling of NTFS Directory Junctions

A flaw was found in BuildKit. An untrusted user, when authoring a build on a Windows Container on Windows WCOW configured BuildKit daemon, can exploit a vulnerability in the cache mount source selector. This flaw allows the user to read arbitrary files from the host system, leading to information...

CVE-2026-0637: Insertion of Sensitive Information into Log File

When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensiti...

PT-2026-68666

Name of the Vulnerable Software and Affected Versions FoundationAgents MetaGPT versions prior to 0.8.3 Description A path traversal issue exists in the read function within the metagpt/tools/libs/editor.py file. This flaw allows a local attacker to access files and directories outside the intende...

PT-2026-68371

Name of the Vulnerable Software and Affected Versions ananocoai NanoClaw versions prior to 2.0.65 Description A path traversal issue exists in the send file component within the file container/agent-runner/src/mcp-tools/core.ts. This flaw allows a remote attacker to manipulate file paths to acces...

EulerOS 2.0 SP15 : python-lxml (EulerOS-SA-2026-2942)

According to the versions of the python-lxml packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default...

EulerOS 2.0 SP13 : python-lxml (EulerOS-SA-2026-2990)

According to the versions of the python-lxml packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default...

EulerOS 2.0 SP13 : python-lxml (EulerOS-SA-2026-3040)

According to the versions of the python-lxml packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default...

PT-2026-68484

Name of the Vulnerable Software and Affected Versions MonomythDevelopment la-forge-mcp versions prior to 1.1.1 Description A path traversal issue exists in the screenshotElement function within the src/index.ts file of the screenshot element Tool. This flaw allows a remote attacker to manipulate...

EulerOS 2.0 SP15 : python-lxml (EulerOS-SA-2026-2901)

According to the versions of the python-lxml packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default...

CVE-2026-15788

A flaw was found in BuildKit. An untrusted user, when authoring a build on a Windows Container on Windows WCOW configured BuildKit daemon, can exploit a vulnerability in the cache mount source selector. This flaw allows the user to read arbitrary files from the host system, leading to information...

CVE-2026-70607

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, some window options supplied by web content in the window.open features string were applied to the new BrowserWindow without an allowlist...

CVE-2026-20313

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...

CVE-2026-20310

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...

MAL-2026-13355 Malicious code in @astralcore/sl-aura (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91ae2c72e5e03d23f3f5704859e8c92b9ce6c565c6d14d744d4382b980a0d233 This WhatsApp bot package ships several mechanisms that give the author persistent remote control of any installer's running instance and access to t...

Malicious code in @astralcore/sl-aura (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91ae2c72e5e03d23f3f5704859e8c92b9ce6c565c6d14d744d4382b980a0d233 This WhatsApp bot package ships several mechanisms that give the author persistent remote control of any installer's running instance and access to t...

CVE-2026-20313

CVE-2026-20313 relates to memory corruption vulnerabilities in Cisco Catalyst SD-WAN components stemming from improper link resolution before file access (CWE-1284). The connected CVE records reference Cisco’s internal security hardening releases addressing multiple previously discovered issues. ...

CVE-2026-20313 Cisco Catalyst SD-WAN Security Hardening Release - Memory Corruption Vulnerabilities

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...

CVE-2026-20313

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...

EUVD-2026-53476

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...