MAL-2026-14566 Malicious code in veloq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 058b0f85e80ad1893e8546161034450eaac2165d5eb7299710f0870bc26b05b2 [email protected] is a near-verbatim fork of gulplog rebranded by 'Blockvora Team', with two injected lines inside getLogger in index.js: a call to...

Malicious code in morglog (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70fd694cbd6fff160cc788117eac2e85e921870f0a2a2e24dbaf81418ed19a1 [email protected] is published under a name resembling the popular morgan HTTP logger and reuses morgan's description. The tarball ships only LICENSE,...

CVE-2026-76227

A flaw was found in Renovate. The application fails to restrict environment variables when it creates new child processes. This oversight allows these child processes, such as those used for package installation or post-upgrade tasks, to access all environment variables of the main Renovate...

CVE-2026-71211

A flaw was found in MLflow's AI Gateway where an unvalidated apibase value in a gateway secret could lead to a Server-Side Request Forgery SSRF vulnerability. An authenticated user, even with read-only privileges, can create a secret with an internal network address. This allows the gateway proxy...

Malicious code in imo-allowlist-xss-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76f429a987c3b4800204131b27faae0c29e55a0761a1fa2a0306ab14a343afd7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in rn-push-provisioning (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77239db1bdbbae9f987b93749d88f1ea172ac43523377e2a47a40a0e0177a023 The package's package.json declares a preinstall lifecycle script node beacon.js || true that runs automatically during npm install. beacon.js reads...

Malicious code in @cortana-md/engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d849c8409247f2e6aa75683bf87afacaf8db81daded8235a622e952c94ccbb7f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14553 Malicious code in @cortana-md/engine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d849c8409247f2e6aa75683bf87afacaf8db81daded8235a622e952c94ccbb7f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in bnotify-web-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0861227aa2c7246f74708656f530b7f99a71f6e6e0be93a1ea7dc3b2d6c814d1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14546 Malicious code in dumb-binding-gyp-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c522e725eb8c0c66cf1c713d966b16c91947d48c6fbe50af8782537f944b6da The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in the_tax_free_cashier_is_at_9f (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0596e225c3ec8b9dfbd5c47b4c4c02d5f5f15c1aff917e7ab480c21936184164 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in grandfather_of_the_desert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 225060668f93f07494e2698abf079d6214336445f644fe5f3b54e3e758b45927 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14548 Malicious code in shai_hulululud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f613531d1e90bc815213b8b20e3f1d9c8889cb7429fe986306747a3b7da99f49 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-46370

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint GET /api/v1/fleet/labels/id/hosts allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a...

CVE-2026-46371

Fleet (open-source device management platform built on osquery) versions up to 4.84.1 have a vulnerability in the Apple MDM commands endpoint (GET /api/v1/fleet/mdm/apple/commands). An unvalidated user-supplied order_key parameter, passed to a deprecated ORDER BY helper that joins the hosts and n...

CVE-2026-46371 Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint GET /api/v1/fleet/mdm/apple/commands allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined...

CVE-2026-46371 Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the Apple MDM commands listing endpoint GET /api/v1/fleet/mdm/apple/commands allowed an authenticated user with the lowest-privilege Observer role to extract sensitive values from joined...

CVE-2026-46370

Fleet (open-source device management platform built on osquery) versions up to 4.84.1 contained an ORDER BY oracle in the labels host-listing endpoint (GET /api/v1/fleet/labels/{id}/hosts). An unvalidated order_key parameter allowed Observer-level users to binary-search long-lived enrollment secr...

CVE-2026-46370 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint GET /api/v1/fleet/labels/id/hosts allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a...

CVE-2026-46370 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint

Fleet is an open-source device management platform built on osquery. In versions up to and including 4.84.1, the labels host-listing endpoint GET /api/v1/fleet/labels/id/hosts allowed an authenticated user with the lowest-privilege Observer role to extract host enrollment secrets through a...