Malicious code in simple-date-formatter-util-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6ec6c790f702e0bb6617bb6bf16ad8b3a154bc7d539938535cde7a2cf205f17 The package's npm postinstall script curls cloud instance-metadata endpoints AWS 169.254.169.254, Alibaba 100.100.100.200, Tencent...

MAL-2026-12197 Malicious code in simple-date-formatter-new-6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcbd38bc87a61131881784bb9e919a03a4cfa2f69934fd17e3735b34ce75e3f6 package.json declares a postinstall script that runs a shell pipeline collecting host identifiers uname, id, routing and ARP tables, TCP-probe result...

Malicious code in simple-date-formatter-new-6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcbd38bc87a61131881784bb9e919a03a4cfa2f69934fd17e3735b34ce75e3f6 package.json declares a postinstall script that runs a shell pipeline collecting host identifiers uname, id, routing and ARP tables, TCP-probe result...

CVE-2026-17515

The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin & MLS Plugin for Real Esta...

CVE-2026-71211 mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

CVE-2026-71210

Mealie is affected by a DNS-rebinding TOCTOU in its AsyncSafeTransport SSRF guard. The guard validates a target host by resolving its IP once and checking private-range rules, but the actual outbound request is issued using the original hostname, which is re-resolved by the underlying transport. ...

CVE-2026-71210 mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access

Mealie's AsyncSafeTransport SSRF guard mealie/pkgs/safehttp/transport.py resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independentl...

CVE-2026-71210

Mealie's AsyncSafeTransport SSRF guard mealie/pkgs/safehttp/transport.py resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independentl...

CVE-2026-71210 mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access

Mealie's AsyncSafeTransport SSRF guard mealie/pkgs/safehttp/transport.py resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independentl...

CVE-2026-71210 mealie - DNS-Rebinding TOCTOU in SSRF Guard Allows Internal Network and Cloud Metadata Access

Mealie's AsyncSafeTransport SSRF guard mealie/pkgs/safehttp/transport.py resolves a target hostname once, checks the resolved IP against private-range rules, but then issues the actual outbound HTTP request using the original hostname, which the underlying async transport re-resolves independentl...

CVE-2026-71208 KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...

CVE-2026-71208 KubeSphere - SSRF via Unvalidated Cluster CRD Connection Endpoint in Cluster Reconciliation

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...

CVE-2026-71208

KubeSphere CVE-2026-71208 describes SSRF risk in the cluster-controller reconciliation. The addCluster path reads every Cluster CRD’s connection config and calls Discovery().ServerVersion() against the CRD-specified Kubernetes API endpoint, using only URL syntax validation (no allow/deny list for...

CVE-2026-71208

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...

EUVD-2026-53205

KubeSphere's cluster-controller reconciliation pkg/utils/clusterclient/clusterclient.go, addCluster processes every Cluster custom resource's connection configuration and immediately calls Discovery.ServerVersion against the CRD-specified Kubernetes API endpoint, which is parsed only for URL synt...

CVE-2026-17515

The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin, in versions prior to 7.0.4 , is vulnerable to sensitive information disclosure. The root cause is a lack of authorisation and CSRF checks in one of its AJAX actions (specifically mlsimport_logger_per_item). This fla...

CVE-2026-17515 MLS Import < 7.0.4 - Subscriber+ Sensitive Information Disclosure via mlsimport_logger_per_item

The MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin before 7.0.4 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the contents of the MLSImport: IDX Plugin & MLS Plugin for Real Esta...

Malicious code in data-format-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21db9b8662eac789b1523c3f2114daa6a5fd3a2a0c7bbfb58fafdf3b4809c7cd The package advertises itself as a data-formatting utility but ships a postinstall.js that auto-executes on npm install and runs shell commands to...

MAL-2026-12039 Malicious code in data-format-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21db9b8662eac789b1523c3f2114daa6a5fd3a2a0c7bbfb58fafdf3b4809c7cd The package advertises itself as a data-formatting utility but ships a postinstall.js that auto-executes on npm install and runs shell commands to...

SUSE CVE-2026-9147

uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields for example, streamer element names are interpolated into the generated Python source without safe quoting via repr or the !r...