Malicious code in pubsub2inbox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bf686448f618fa764676453e2c0b7436f7c50c2043cc2734d2fcc142fb86f951 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-1993 Malicious code in pubsub2inbox (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bf686448f618fa764676453e2c0b7436f7c50c2043cc2734d2fcc142fb86f951 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in perfkitbenchmarker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0983513b915ec02c736c073b1af861f5ff6b1e62bf2074b42a33e8d5fa16bb46 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-1992 Malicious code in perfkitbenchmarker (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0983513b915ec02c736c073b1af861f5ff6b1e62bf2074b42a33e8d5fa16bb46 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in composer-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7be3393e5cd932abe1668adaa58f526e25b1a6ab2ef4945eadeb60e68493c7ef Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-1987 Malicious code in composer-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7be3393e5cd932abe1668adaa58f526e25b1a6ab2ef4945eadeb60e68493c7ef Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in dataflux-pytorch (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 486e56ad4de2a59b9c8890d854505075b556ca6920be97f850a14c7d648f7f3b Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-1988 Malicious code in dataflux-pytorch (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 486e56ad4de2a59b9c8890d854505075b556ca6920be97f850a14c7d648f7f3b Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in mcp-transport-proto (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a40306e4035df29c739d5073ccb341685275d5cebba588b7014898229752e11f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-1990 Malicious code in mcp-transport-proto (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a40306e4035df29c739d5073ccb341685275d5cebba588b7014898229752e11f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-1986 Malicious code in cloud-datasets (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7cbbef34e9c8a9e6db79ffb59dde86dafe9734166f201aae8a5d1837ac262fc0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in cloud-datasets (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7cbbef34e9c8a9e6db79ffb59dde86dafe9734166f201aae8a5d1837ac262fc0 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in azure-eventhub-checkpointstoretable (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e41a629242e28270fbee568718ddef63da1e359ad5a5a1401ed85c48ef870d73 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2026-33131

H3 is a minimal HTTP framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl which extends FastURL which allows middleware bypass. When event.url, event.url.hostname, or event.url.url is accessed, such as in a logging middleware, the url...

CVE-2026-33131

CVE-2026-33131 affects H3, a minimal HTTP framework. Versions 2.0.0-0 through 2.0.1-rc.14 expose a Host header spoofing flaw in the NodeRequestUrl/FastURL path, enabling middleware bypass when an attacker manipulates event.url properties (e.g., via Host header) so route matching succeeds but auth...

CVE-2026-33131 h3 has a middleware bypass with one gadget

H3 is a minimal HTTP framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl which extends FastURL which allows middleware bypass. When event.url, event.url.hostname, or event.url.url is accessed, such as in a logging middleware, the url...

CVE-2026-33131 h3 has a middleware bypass with one gadget

H3 is a minimal HTTP framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl which extends FastURL which allows middleware bypass. When event.url, event.url.hostname, or event.url.url is accessed, such as in a logging middleware, the url...

CVE-2026-33131 h3 has a middleware bypass with one gadget

H3 is a minimal HTTP framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl which extends FastURL which allows middleware bypass. When event.url, event.url.hostname, or event.url.url is accessed, such as in a logging middleware, the url...

BIT-JENKINS-2026-33002

Jenkins 2.442 through 2.554 both inclusive, LTS 2.426.3 through LTS 2.541.2 both inclusive performs origin validation of requests made through the CLI WebSocket endpoint by computing the expected origin for comparison using the Host or X-Forwarded-Host HTTP request headers, making it vulnerable t...

Malicious code in el-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a3c49d25d54c1bd3e1e5ba1ab4996329e8244ba30c1639f977985930fafd91f The package el-icon was found to contain malicious code. Source: ghsa-malware a5783aeff6b8639c7ecb526c39e297c96949bead58c8e1aabf1be7417d75e696 Any...