278362 matches found
Malicious code in devplatform-data-table (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d9d428dae035b88a4c025d9edd346d22cf2dffbb5a21ae597560702280b3949 On require'devplatform-data-table', index.js loads ext.js inside a swallowed try/catch. ext.js reconstructs a rotating list of Cloudflare Workers...
Malicious code in content-publisher-sdks (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3faac0139a1c2fd25d8b955e9290380bec365a1d3034fb793dfa723cb930463 package.json declares a preinstall hook that runs index.js on npm install. The script collects host reconnaissance os.hostname, os.userInfo, homedir,...
RHSA-2026:50281 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...
RHSA-2025:7118 Red Hat Security Advisory: osbuild and osbuild-composer security update
Bulletin has no description...
RHSA-2023:0777 Red Hat Security Advisory: OpenShift Container Platform 4.9.56 security update
Bulletin has no description...
MAL-2026-12209 Malicious code in statist-browser-typed-client-ddp.mentat.ui.web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dc78a545236395c12156cd5f8e36337df53024afd0a6a6da75f81fb9b7c11e7 The package's main entry index.js loads polyfill.js, which on module load detects OS and architecture, fetches a per-platform binary over HTTPS from...
Session Hijacking
MCP Ruby SDK is vulnerable to Session Hijacking. The vulnerability is due to missing session ownership validation in StreamableHTTPTransport, allowing attackers with a stolen session ID to execute tool calls within the victim's session...
Malicious code in beaver-ui-hooks (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86ba5710d957735b0f3fde73e6b6ba99347296b8dc992db5f1807924f3ffc139 The package's declared main index.js unconditionally loads ext.js, which on require fetches a platform-specific binary from obfuscated Cloudflare...
MAL-2026-12137 Malicious code in accounts-timeline (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06f6dc7646dee511daf68d4339b812a1ac11a8edbc6d6b9494c5b3141692c3df On require of the package's main entry, index.js loads setup.js, which schedules a platform-selection routine via process.nextTick. Depending on...
Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2026.
Summary In addition to many updates of operating system level packages, the following security vulnerabilities are addressed with IBM Cloud Pak for Business Automation released in July 2026. Vulnerability Details CVEID:CVE-2026-40984 DESCRIPTION: In Micrometer, it is possible for a user to provid...
CVE-2026-68075 Apache Qpid Broker-J: Incoming session flow control window can be exceeded
An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.0.1. Users are recommended to upgrade to version 10.1.0, which fixes the issue...
Photon OS 5.0: Rust PHSA-2023-5.0-91-0067
An update of the rust package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0067. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Sqlite PHSA-2026-5.0-92-0889
An update of the sqlite package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-92-0889. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Linux PHSA-2024-5.0-91-0374
An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0374. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
CVE-2026-70485 Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.0, Open WebUI checked whether a user-supplied URL destination was globally routable by applying ipaddress.isglobal to the literal IPv6 address without examining IPv4 addresses embedded in...
Malicious code in @servicetitan/microfront-tests (npm)
npm/@servicetitan/microfront-tests is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
Malicious code in @servicetitan/acquisition-functions (npm)
npm/@servicetitan/acquisition-functions is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized...
MAL-2026-11841 Malicious code in @servicetitan/contentful (npm)
npm/@servicetitan/contentful is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...