Grafana 3.0.1-7.0.1 - Server-Side Request Forgery

Grafana 3.0.1 through 7.0.1 is susceptible to server-side request forgery via the avatar feature, which can lead to remote code execution. Any unauthenticated user/client can make Grafana send HTTP requests to any URL and return its result. This can be used to gain information about the network...

nerva v1.69.2

Nerva Nerva: Fast Service Fingerprinting CLI Features • Installation • Quick Start • Usage • Protocols • Library • Use Cases • Troubleshooting High-performance service fingerprinting written in Go. Identify 170+ network protocols across TCP, UDP, and SCTP transports with rich metadata extraction...

CVE-2026-76361

In Splunk SOAR versions below 8.6.0, a user with the "Administrator" role could use the /rest/support/connectivity/.../checkconnectivity endpoint to make Splunk SOAR initiate outbound network connections to arbitrary destinations and determine whether internal hosts and ports are reachable. The...

PT-2026-77237

Name of the Vulnerable Software and Affected Versions MagicMirror² versions prior to 2.37.0 Description The checkArticleUrl function in defaultmodules/newsfeed/node helper.js accepts the CHECK ARTICLE URL notification via the unauthenticated Socket.IO namespace /newsfeed. The system performs a...

MAL-2026-13950 Malicious code in fmt-util-k7x2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e8613ffc5393a31685344c247925a5ef104f7daf3f0d2f45a51918adba7d344 [email protected] advertises itself as a trivial string-formatting utility index.js exports two-line pad/trim helpers, but its package.json declare...

MAL-2026-13850 Malicious code in @years18/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0940a90826ae5cd1b3d36dbbebd7813996ccbcf80e8c24759829dad3c17ed66e Package is presented as an n8n community node but the only node file nodes/PwnNode.node.js is a 213-byte stub; the real behavior is in callback.js,...

Malicious code in @years18/n8n-nodes-utils-helper-d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0940a90826ae5cd1b3d36dbbebd7813996ccbcf80e8c24759829dad3c17ed66e Package is presented as an n8n community node but the only node file nodes/PwnNode.node.js is a 213-byte stub; the real behavior is in callback.js,...

CVE-2026-18348

Missing authorization check in the uploadazure, uploadsftp, and uploadsmb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network...

CVE-2026-18348 Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins

Missing authorization check in the uploadazure, uploadsftp, and uploadsmb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network...

CVE-2026-18348 Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins

Missing authorization check in the uploadazure, uploadsftp, and uploadsmb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission boundary. This enables internal network...

nerva v1.64.3

Nerva Nerva: Fast Service Fingerprinting CLI Features • Installation • Quick Start • Usage • Protocols • Library • Use Cases • Troubleshooting High-performance service fingerprinting written in Go. Identify 170+ network protocols across TCP, UDP, and SCTP transports with rich metadata extraction...

nerva v1.61.0

Nerva Nerva: Fast Service Fingerprinting CLI Features • Installation • Quick Start • Usage • Protocols • Library • Use Cases • Troubleshooting High-performance service fingerprinting written in Go. Identify 170+ network protocols across TCP, UDP, and SCTP transports with rich metadata extraction...

Malicious code in @activepieces/piece-google-bigquery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acc3321f587f5a8efea8256aeb935a905df2da5f5a901cd8f7355a75e3832da3 The package presents itself as an Activepieces connector for Google BigQuery but src/index.js combines require"childprocess", an OS reconnaissance...

Malicious code in @cryptosrvc/no-brainer-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7955af180bb00f4f97b5dee0c7020f9e43f4c35aa84c5ef5446dd95646eb333b On npm install, the package's postinstall script dist/recon.js collects installer-side host reconnaissance — hostname, username, SUDOUSER, home...

Malicious code in simple-date-formatter-new-8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f0bf9e4040cf2940b0ca9a9e5cea7def2c660925afd0ba959ed69d28ca007b7 The package.json postinstall script runs unconditionally on npm install, collecting host and internal-network reconnaissance kernel version via uname...

nerva v1.57.0

Nerva Nerva: Fast Service Fingerprinting CLI Features • Installation • Quick Start • Usage • Protocols • Library • Use Cases • Troubleshooting High-performance service fingerprinting written in Go. Identify 170+ network protocols across TCP, UDP, and SCTP transports with rich metadata extraction...

nerva v1.53.1

Nerva Nerva: Fast Service Fingerprinting CLI Features • Installation • Quick Start • Usage • Protocols • Library • Use Cases • Troubleshooting High-performance service fingerprinting written in Go. Identify 170+ network protocols across TCP, UDP, and SCTP transports with rich metadata extraction...

Malicious code in n8n-nodes-pwn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae8222d3f90f4cff83a0840ee03f4b127946274f0215a73eadd6008404a2276e The package's Pwn.node.js executes malicious code at module load time when n8n loads this community node. It opens a TCP socket to 10.0.0.145:4444 an...

MAL-2026-10998 Malicious code in n8n-nodes-port-scanner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cffdebe2e0a27deb3751af547baace8a403244cb92d214db726d3700a192d61e index.js executes a top-level IIFE at require-time that 1 runs hostname, hostname -I, id, ip route, ip neigh/arp and reads /etc/resolv.conf, opens a...

nerva v1.42.9

Nerva Nerva: Fast Service Fingerprinting CLI Features • Installation • Quick Start • Usage • Protocols • Library • Use Cases • Troubleshooting High-performance service fingerprinting written in Go. Identify 170+ network protocols across TCP, UDP, and SCTP transports with rich metadata extraction...