MAL-2026-16107 Malicious code in @auction-fe/portal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c9a0273cadda58738fa01d0c67fb17edd588f5870a13128a4aa47820f6a13fab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @auction-fe/base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4430765bbffe0f1b4471a3d1dbafdbc97059e7717fc6a1967fd5ebf05b83a0ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @auction-fe/ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0383eb0003b48f9a03fefc5a97f9a4b4a2c7756fa1cbced8995bb05838ff404f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @auction-fe/reporting-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a41fe4ef01818c699bc5c1953702b37cb566a58b0b4769a7ae532b05699b130 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CLSA-2026-1788988912 TuxCare security update for unhead (2 CVEs)

TuxCare rebuilt unhead to address 2 CVEs. Fixed in 1.11.20-tuxcare.1...

MAL-2026-16101 Malicious code in mfaby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c278e0ee3820cf701ef7ad65dfdab43a0765e5d3423286de99d3301fe39a8455 The package presents itself as a Discord MFA helper, but its cache module contains a warmSession routine that decodes a base64-encoded string CDNBASE...

MAL-2026-16100 Malicious code in discord-mfa-solver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a91086c84ad0836c4b32ee5db890c9a6d9543f00e9dd31d18aed8a6acc9bdb3e On require of the package, lib/cache.js reached from index.js executes trymodule'require'catch — a bracket-notation, error-swallowed dynamic require ...

GHSA-RCR6-4JQH-J84M vulnerabilities

Vulnerabilities for packages: gitea, gitea-fips...

GHSA-QC2Q-P7WX-3PX3 vulnerabilities

Vulnerabilities for packages: k8sgpt, dapr-fips, knative-serving, gcp-compute-persistent-disk-csi-driver-fips, consul, kubernetes-fips, knative-kafka-broker-fips, commercial-kyverno, smarter-device-manager, docker, gitlab-pages, lvm-driver, cloudflared, volcano-fips, k8ssandra-client,...

CVE-2026-67322 vulnerabilities

Vulnerabilities for packages: datahub-ingestion-fips, datahub-ingestion, checkov, awx, mlflow, opal, mlflow-fips...

CVE-2026-76219 vulnerabilities

Vulnerabilities for packages: awx, checkov, mlflow, opal...

GHSA-4VPG-PFJ8-M33Q vulnerabilities

Vulnerabilities for packages: mlflow, checkov...

CVE-2026-76222 vulnerabilities

Vulnerabilities for packages: mlflow, checkov...

CVE-2026-53956 Rattler vulnerable to package cache path traversal via conda package build string

Rattler is a library that provides common functionality used within the conda ecosystem. rattlercache prior to version 0.9.0 and py-rattler prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the...

EUVD-2026-75141

Rattler is a library that provides common functionality used within the conda ecosystem. rattlercache prior to version 0.9.0 and py-rattler prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the...

CVE-2026-53956

Rattler is a library providing common functionality for the conda ecosystem. rattler_cache prior to 0.9.0 and py-rattler prior to 0.24.0 are vulnerable to package-cache path traversal . During cache materialization, the package record build string is joined into a filesystem path without proper s...

CVE-2026-53956 Rattler vulnerable to package cache path traversal via conda package build string

Rattler is a library that provides common functionality used within the conda ecosystem. rattlercache prior to version 0.9.0 and py-rattler prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the...

NPM: smol-toml: Denial of Service via malformed TOML documents

NPM: smol-toml: Denial of Service via malformed TOML documents vulnerability discovered by ? in WordPress Npm smol-toml versions = 1.7.0...

Malicious code in matrixkit-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51238ce279c2ff37d32c5edd8a9cb480f1a304720cb67e5acf3ee50e91c773c4 The package advertises itself as a dense-matrix math library but its main entry matrix.js has been modified post-build to require'./src/init' and...

Malicious code in twilio-hackerone-poc-b8f21a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 09b67e9bd1be2e2e13aae83616afffcbfdc3fb888b304dc7210be0ee39832aac On npm install, postinstall.js automatically executes and performs host reconnaissance and exfiltration to a hardcoded ephemeral Cloudflare Quick...