Malicious code in @ifasn/md-doc-mcp (npm)

Source: amazon-inspector 808d25733e867c0cb6808f89bbed4cc90e8362b1e1a2e52759676d51bd0273bb The package is advertised as a markdown toolkit MCP server TOC generation, word count, table formatting but on require of its main module and on startup of its md-doc-mcp bin it probes cloud-provider...

Malicious code in @ifasn/md-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 808d25733e867c0cb6808f89bbed4cc90e8362b1e1a2e52759676d51bd0273bb The package is advertised as a markdown toolkit MCP server TOC generation, word count, table formatting but on require of its main module and on...

MAL-2026-18486 Malicious code in @ifasn/md-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 808d25733e867c0cb6808f89bbed4cc90e8362b1e1a2e52759676d51bd0273bb The package is advertised as a markdown toolkit MCP server TOC generation, word count, table formatting but on require of its main module and on...

CVE-2026-114076 Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud...

CVE-2026-114076 Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud...

CVE-2026-114076

Versions of Trigger.dev prior to 4.5.2 are vulnerable to a blind server-side request forgery (SSRF) vulnerability. The root cause is the use of an unvalidated webhook alert channel URL , which allows authenticated tenants to force the webapp server to send POST requests to internal hosts. Exploit...

CVE-2026-114076 Trigger.dev before 4.5.2 Blind SSRF via Alert Channel Webhook URL

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud...

EUVD-2026-107027

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud...

PT-2026-120202

Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send POST requests to internal hosts by setting an unvalidated webhook alert channel URL. Attackers can point the webhook at internal services or cloud...

CVE-2026-12944

IBM Langflow OSS 1.0.0 through 1.10.0 can allow attackers to execute arbitrary Python code with root privileges UID=0 on the Langflow server by submitting components containing socket or urllib imports. This enables: 1 AWS credential theft via IMDSv1 SSRF with full IAM role permissions, 2 arbitra...

PT-2026-91736

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.10.0 Description An incomplete security scanner blocklist allows attackers to execute arbitrary Python code with root privileges UID=0 on the server by submitting components that import socket or urlli...

PT-2026-76480

Summary Open WebUI vetted user-supplied URLs by resolving the hostname once and rejecting private, loopback and link-local addresses, then let the HTTP client resolve that hostname again at connect time. An attacker who controls the authoritative DNS for a hostname they submit can answer with a...

Malicious code in n8n-nodes-security-test-poc (npm)

Source: amazon-inspector fa97d4701c29ef5305fa5b553ab560abd6db6cc33b72f99dc11621997b668f32 Package presents as an n8n community node but is an attack artifact. The node's execute in dist/SecurityTestNode.node.js queries AWS IMDSv1/v2 http://169.254.169.254/latest/meta-data/iam/security-credentials...

Malicious code in ledgerflow-deploy-utils (npm)

Source: amazon-inspector 5f0097d19be676ac30ff79dffcff38f128873c80115a8a150c3eceff0422aa93 On npm install, the package's postinstall script queries the AWS instance metadata service IMDSv1 at 169.254.169.254 for the attached IAM role and POSTs the result, along with an IMDS-reachability probe, ove...

CVE-2026-39361

OpenObserve is a cloud-native observability platform. In 0.70.3 and earlier, the validateenrichmenturl function in src/handler/http/request/enrichmenttable/mod.rs fails to block IPv6 addresses because Rust's url crate returns them with surrounding brackets e.g. "::1" not "::1". An authenticated...

TotalCloud Insights: Unmasking AWS Instance Metadata Service v1 (IMDSv1)-The Hidden Flaw in AWS Security

Introduction Imagine a breach that cost a company over $150 million in fines, remediation, and lost trust. In 2019, this was an all-too-real situation for one business when vulnerabilities in AWS Instance Metadata Service v1 IMDSv1 were exploited. A single Server-Side Request Forgery SSRF attack,...

PT-2023-36324 · Amazon · Ec2 Hibagent

Name of the Vulnerable Software and Affected Versions: EC2 hibagent versions prior to the update that adds IMDSv2 support Description: The issue concerns the use of an insecure protocol by IMDSv1, which is no longer recommended. The EC2 hibagent package has been updated to add IMDSv2 support...

PT-2023-36323 · Amazon · Ec2 Hibagent

Name of the Vulnerable Software and Affected Versions: EC2 hibagent affected versions not specified Description: The issue concerns the use of an insecure protocol by IMDSv1, which is no longer recommended. To address this, the EC2 hibagent package has been updated to add support for IMDSv2...

PT-2023-36322 · Canonical · Hibagent

Name of the Vulnerable Software and Affected Versions: hibagent versions prior to the updated version for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS Description: The issue concerns the use of an insecure protocol by IMDSv1, which is no longer recommended. To address this, the hibagent package has been...