MAL-2026-17250 Malicious code in @hrmony/api-gateway-service-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a48388c29a59698997efcb654da3c9182138846dad274f82ad2a1101843c5e4 index.js runs a top-level await fetch... on import that harvests installer host secrets and posts them to the hardcoded attacker endpoint...

MAL-2026-17277 Malicious code in @hrmony/pladddform-infrastructure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a26b9f2a46bdc8abd9882683d792c8fff6d94a9b89cc68162339e7fede47ceb On any require/import of @hrmony/pladddform-infrastructure, top-level code POSTs a beacon to the hardcoded attacker endpoint...

Malicious code in @hrmony/belegerfassung-pladddform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 615255a66c44204b03e60a165c1a9b21f95ecd351bf58c355462c159c74d1017 The package's main module index.js executes exfiltration logic at top level on import. It first sends a hello beacon via HTTP POST to the hardcoded...

Malicious code in @hrmony/devtool-configuration (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f83cb569df9c47639ee0fd16c34a4ac1b97b89733b1b468389d8032087ab233b On import, index.js performs an unconditional POST beacon to https://hrnmn.dd.h4x.tv/saveinstanceinfofrompkgehrmonydevtool-configuration, then querie...

MAL-2026-17276 Malicious code in @hrmony/pladddform-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f03abfe6149423144b6d3143a66cbca7925bb6eb736b1ece350d5a344684eb9 @hrmony/[email protected] ships an index.js whose top-level code, executed on require/import, POSTs to the hardcoded attacker host...

Malicious code in @hrmony/pladddform-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f03abfe6149423144b6d3143a66cbca7925bb6eb736b1ece350d5a344684eb9 @hrmony/[email protected] ships an index.js whose top-level code, executed on require/import, POSTs to the hardcoded attacker host...

MAL-2026-17275 Malicious code in @hrmony/pladddform-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9e61c4d5d499198c568d9f255e23b407eb7e47f7272c76bf5f50a0d0db31605 On top-level module load, index.js queries the AWS instance metadata service at 169.254.169.254 IMDSv2, retrieves the instance identity document,...

IAM for AI agents: A Practical Enterprise Framework

What is IAM for AI agents? AI agents authenticate, invoke tools, and act across enterprise systems with delegated authority. IAM for AI Agents is the identity-control architecture that governs those actors. This guide covers the limits of conventional provisioning, the components that matter, how...

CVE-2026-55160

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery SSRF vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata...

CVE-2026-55160 Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery SSRF vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata...

EUVD-2026-88400

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery SSRF vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata...

CVE

Control Tower Notification Enabler Este paquete cdk instala una función Lambda, con un rol IAM asociado, y suscribe la función Lambda a las notificaciones de seguridad agregadas de Control Tower. En caso de una violación de una regla de Control Tower por ejemplo, un bucket S3 de acceso público, l...

CVE-2026-55160: Server-Side Request Forgery (SSRF)

Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery SSRF vulnerability allows any authenticated user to force the Stringer server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud metadata...

PT-2026-102289

Name of the Vulnerable Software and Affected Versions Stringer versions prior to commit 75cb095 Description An unrestricted Server-Side Request Forgery SSRF allows authenticated users to force the server to send arbitrary HTTP/HTTPS requests to internal networks, localhost services, and cloud...

BIT-RCLONE-2026-79780 rclone before v1.75.0 Credential Exposure via S3 Redirect

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

PT-2026-99019

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host...

EUVD-2026-83976

Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler...

PT-2026-96902

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description An unauthenticated caller can perform a Server-Side Request Forgery SSRF attack using a DNS-rebinding technique. The software employs a validate-then-use pattern where the validate url for ssr...

PT-2026-96798

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.18.0 Description An authenticated user with remote-download access can perform a Server-Side Request Forgery SSRF by providing a specially crafted SrcUri through the RemoteDownloadTask.createDownloadTask function...

PT-2026-96826

Name of the Vulnerable Software and Affected Versions LightRAG versions prior to 1.5.5 Description LightRAG contains a Server-Side Request Forgery SSRF issue in its native markdown parser. The validated addresses function in lightrag/parser/markdown/parser.py fails to consistently decode IPv6...