CVE-2026-70615

boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorizedkeys file by supplying a percent-encoded newline character in the domain parameter...

CVE-2026-70615 boringproxy 0.10.0 SSH authorized_keys Injection via Tunnel Creation

boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorizedkeys file by supplying a percent-encoded newline character in the domain parameter...

CVE-2026-70615

Boringproxy 0.10.0 is affected by a newline injection in the tunnel-creation endpoint’s domain parameter, enabling authenticated, low-privilege users with tunnel-creation permission to inject lines into the SSH authorized_keys file. This may allow insertion of an unrestricted public key, granting...

EUVD-2026-53584

boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorizedkeys file by supplying a percent-encoded newline character in the domain parameter...

Malicious code in devplatform-utils (npm)

Source: amazon-inspector 0244bc7396ea5f52d909130a7d685fee98c0dda29cb18b82d17e8c9c90dff552 [email protected] ships an index.js whose main module requires bootstrap.js, which on load downloads a platform-specific binary payload from string-split-obfuscated Cloudflare Workers endpoints e.g...

MAL-2026-13363 Malicious code in @cliphijack/santaclaude (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6a4fa42a55635225fb914eaea97cbc9699efb6cc197445eacf32e6592b60675 The santaclaude bin opens a persistent WebSocket connection to https://santaclaude.app and long-polls /api/control/claim. Messages received from the...

Malicious code in app-hsu-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad1ccd2bfbe4abd87e980067608328d6c0a6cb3d1145d8d8ff8d72a22667f00d On npm install, the package's postinstall script runs test.js, which imports index.js and immediately invokes two harvesting/backdoor routines. The...

MAL-2026-13357 Malicious code in app-hsu-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad1ccd2bfbe4abd87e980067608328d6c0a6cb3d1145d8d8ff8d72a22667f00d On npm install, the package's postinstall script runs test.js, which imports index.js and immediately invokes two harvesting/backdoor routines. The...

MAL-2026-13065 Malicious code in boxy-maker-sticky (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc3701b8f91a045a21b2a07ba76082afea03e4aea2c9a87a1c1e40e2de88c3b0 On require of boxy-maker-sticky, index.js loads runtime.js which reconstructs C2 hostnames from split string fragments...

MAL-2026-12529 Malicious code in cardsmobile-cardsmobile-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 657552d9de3cceb4fd25921aea0f1470d8c6f70af574242b4d3e4273367e2d30 On require of cardsmobile-cardsmobile-core, index.js loads shim.js which selects a platform-specific payload path, fetches an unsigned executable fro...

Malicious code in devplatform-po-transformer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 555faac3cf4078b125af0858613813fb3f3bc780a573ddc5713b23d1046c9c71 On require of the package, platform.js detects OS/arch and downloads an opaque binary from Cloudflare Workers hostnames assembled at runtime from...

ALPINE-CVE-2026-71227

A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output AIO interface. By reusing an AIO-enabled handle after a prior completion error, the kcapiaioreadall function can enter a non-terminating wait loop. This can lead to a persistent...

MAL-2026-12418 Malicious code in postcss-animate-css-vars (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e40aa4b6595789e4ba4b39f82e63526286b36a64ffad2be27536c69c8207590 src/normalize-options.js is heavily obfuscated RC4-decoded string array, hex-numeric literals, rotating string-array shuffler, dead-code comparison...

MAL-2026-12345 Malicious code in calendar-streak-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d34b4caa6716625380bd2636072e5fe0473d114ab3fdfd8335f9e1c0e642ddc4 [email protected] is advertised as a dependency-free calendar-day and streak math library, but index.mjs embeds a hex-encoded Windows PE...

Malicious code in agent-bot-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 299eb5fe496022e888ed0663d0be82ddb8fac108bcb9a223291449982c360530 Package establishes a persistent remote-access channel to the hardcoded server https://server.junofficial.biz.id. On load, the client posts the...

MAL-2026-12138 Malicious code in agent-bot-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 299eb5fe496022e888ed0663d0be82ddb8fac108bcb9a223291449982c360530 Package establishes a persistent remote-access channel to the hardcoded server https://server.junofficial.biz.id. On load, the client posts the...

CVE-2026-71206

Shiori's CheckToken function internal/domains/auth.go validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase...

CVE-2026-70615: Improper Neutralization of CRLF Sequences

boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorizedkeys file by supplying a percent-encoded newline character in the domain parameter...

CVE-2026-60053: Insufficient Session Expiration

Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys...

PT-2026-68310

Name of the Vulnerable Software and Affected Versions boringproxy versions prior to 0.10.1 Description Authenticated low-privileged users with tunnel-creation permissions can perform a newline injection. By providing a percent-encoded newline character in the domain parameter of the tunnel creati...