1417 matches found
PT-2026-40973
Name of the Vulnerable Software and Affected Versions CoreShop versions 5.0.1 through 5.1.0-beta.1 Description The GitHub Actions workflow located at .github/workflows/static.yml uses the pull request target trigger and checks out unverified code from the pull request head using the variable ref:...
EUVD-2026-29437
A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint without authentication on port 3088. An unauthenticated remote attacker can invoke the run-code MCP tool to supply arbitrary source code and...
MAL-2026-3693 Malicious code in kaggle-runner (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dcd49ca70b987b236ba4341d839addfec9afb344e1471195f2f825281092f71 kagglerunner/coordinator.py embeds a bash reverse-shell template rvsstr that connects to vtool.duckdns.org:23454 via ncat with retry/backoff plus a...
Malicious code in kaggle-runner (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dcd49ca70b987b236ba4341d839addfec9afb344e1471195f2f825281092f71 kagglerunner/coordinator.py embeds a bash reverse-shell template rvsstr that connects to vtool.duckdns.org:23454 via ncat with retry/backoff plus a...
CVE-2026-5029
A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint without authentication on port 3088. An unauthenticated remote attacker can invoke the run-code MCP tool to supply arbitrary source code and...
CVE-2026-5029 RCE in Code Runner MCP Server
A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint without authentication on port 3088. An unauthenticated remote attacker can invoke the run-code MCP tool to supply arbitrary source code and...
CVE-2026-5029 RCE in Code Runner MCP Server
A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint without authentication on port 3088. An unauthenticated remote attacker can invoke the run-code MCP tool to supply arbitrary source code and...
CVE-2026-5029
CVE-2026-5029 affects Code Runner MCP Server when run with --transport http, exposing the /mcp JSON-RPC endpoint on port 3088 without authentication. An unauthenticated attacker can invoke the run-code MCP tool to supply arbitrary source code and execute it via child_process.exec() using the spec...
CVE-2026-45022 vulnerabilities
Vulnerabilities for packages: grafana-alloy, rancher-fleet, teleport, zarf, pulumi-language-yaml, src-fingerprint, gitsign, terragrunt, trivy, tfsec, wolfictl, kots, flux, bom, steampipe, pulumi-language-dotnet, argo-cd, pulumi-kubernetes-operator, snyk-cli, grype, flux-image-automation-controlle...
GHSA-389R-GV7P-R3RP vulnerabilities
Vulnerabilities for packages: grafana-alloy, rancher-fleet, teleport, zarf, pulumi-language-yaml, src-fingerprint, gitsign, terragrunt, trivy, tfsec, wolfictl, kots, flux, bom, steampipe, pulumi-language-dotnet, argo-cd, pulumi-kubernetes-operator, snyk-cli, grype, flux-image-automation-controlle...
GHSA-389R-GV7P-R3RP vulnerabilities
Vulnerabilities for packages: gitaly-fips, chainloop-cli-fips, cerbos, terragrunt-fips, gomplate, zarf-fips, pulumi, witness, cloudbeat-fips, argocd-image-updater-fips, bom, kyverno, trivy, k9s-fips, trivy-fips, jfrog-cli, external-secrets-operator-fips, coder, steampipe, trufflehog-fips,...
CVE-2026-45022 vulnerabilities
Vulnerabilities for packages: gitaly-fips, chainloop-cli-fips, cerbos, terragrunt-fips, gomplate, zarf-fips, pulumi, witness, cloudbeat-fips, argocd-image-updater-fips, bom, kyverno, trivy, k9s-fips, trivy-fips, jfrog-cli, external-secrets-operator-fips, coder, steampipe, trufflehog-fips,...
Code Runner MCP Server 访问控制错误漏洞
Code Runner MCP Server is a multi-language code execution and result display tool developed by Jun Han. There is an access control vulnerability in Code Runner MCP Server. This vulnerability arises when the --transport http option is used, exposing an unauthenticated /mcp JSON-RPC endpoint on por...
PT-2026-39994
A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, which exposes the /mcp JSON-RPC endpoint without authentication on port 3088. An unauthenticated remote attacker can invoke the run-code MCP tool to supply arbitrary source code and...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...