MAL-2026-243 Malicious code in francium-web-visitors (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72629df67c0b81a1d120987aca534bd8096a0cbb2a9898a327a2dc2d1b8a0a49 The package francium-web-visitors was found to contain malicious code. Source: ghsa-malware...

PT-2026-2441

Name of the Vulnerable Software and Affected Versions Eclipse Che versions affected versions not specified Description A flaw exists in Eclipse Che che-machine-exec that permits unauthenticated remote arbitrary command execution and secret exfiltration, including SSH keys and tokens, from other...

Eclipse Che 访问控制错误漏洞

Eclipse Che is a set of Java-based open source online integrated development environments IDEs from the Eclipse Foundation. An access control error vulnerability exists in Eclipse Che che-machine-exec, which originates from an unauthenticated remote attacker who can execute arbitrary commands and...

CVE-2026-22798

The CVE-2026-22798 issue affects the Hermes workflow tool. It concerns logging of arbitrary options passed via the -O argument, which could cause sensitive data (e.g., API tokens) to be written to log files in plaintext. This behavior occurs in Hermes releases from 0.8.1 up to before 0.9.1. Impac...

CVE-2026-22798 hermes's raw options logging may disclose secrets passed in via subcommand options argument

hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens e.g., via...

CVE-2026-22798 hermes's raw options logging may disclose secrets passed in via subcommand options argument

hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens e.g., via...

CVE-2026-22771 Envoy Extension Policy lua scripts injection causes arbitrary command execution

Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by Envoy proxy can be used to leak the proxy's credentials. These credentials can then be used to communica...

CVE-2026-22771

Summary: CVE-2026-22771 affects Envoy Gateway. Prior to versions 1.5.7 and 1.6.2, EnvoyExtensionPolicy Lua scripts executed by the Envoy proxy can leak credentials (e.g., TLS private keys and other secrets) used by the proxy, enabling access to control-plane secrets. The issue is described across...

GO-2025-4269 SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key in github.com/actiontech/sqle

SQLE's JWT Secret Handler can be manipulated to use hard-coded cryptographic key in github.com/actiontech/sqle...

Malicious code in tailwindcss-animate-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 150bc7ffcbd255578f8dc6e8ce8781a01e97dcdc6a57436976f6b08beb371807 The package tailwindcss-animate-tool was found to contain malicious code. Source: ghsa-malware...

MAL-2026-233 Malicious code in simple-string-utils3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13d9f9db863d718f528caa234dfa722b2631eb76195f504f47670898aeb0634a The package simple-string-utils3 was found to contain malicious code. Source: ghsa-malware...

MAL-2026-228 Malicious code in luxon-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6cf8bc36e6ae424cba2eb02275c950a8211e5342252662276b2c53afa5c8255 The package luxon-js was found to contain malicious code. Source: ghsa-malware 4fc26738db6a8729f71b32abddd5b6da3cce0b05e304b180ed3915f6cd07f746 Any...

MAL-2026-225 Malicious code in jsdom-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 312dfde89b7b4606901cb1278d28d2a7876859e2bd23da752f8c5e4979b9fe8f The package jsdom-js was found to contain malicious code. Source: ghsa-malware c21558fc0a67b24e6df7eddf211f517317d151b885fd971b9fc38608046b733d Any...

MAL-2026-229 Malicious code in milvus-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51a90c757a7d1ca3d7c7a43b2ace0810059fb75ec0a78742889eb69928300d04 The package milvus-js was found to contain malicious code. Source: ghsa-malware cad32ba8c32f231e0bef97a0205ecd76770e320336fb50b85f57b0454747f6fd Any...

Malicious code in pinecone-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c597ee3d643e51ba6eca0553a77be1c79a3e5dc72d8450b09b7f405a558d2d56 The package pinecone-js was found to contain malicious code. Source: ghsa-malware 0e6ef1006a92156684ab8d3e78ab8e036d4c27f591eba5212441a68be8231a66 An...

MAL-2026-215 Malicious code in auth-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec0897a10b33b937c04d8f134ccac05ecdfd6050bbfaffbb07cd3ade9256bd24 The package auth-types was found to contain malicious code. Source: ghsa-malware 1096a2a969c582b5029b85a0c4eb85eec4d53f96c178a1523abe0978392a139d Any...

MAL-2026-214 Malicious code in analytics-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d14b7ad7441a8663be12ffffb8132ef2a0b0124006d5df1b3448d6f722e4f808 The package analytics-browser was found to contain malicious code. Source: ghsa-malware...

Malicious code in @workleap-ai/shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2800f2cfba8ac6e7a16ef977484e4da4d360c859848daedb5220c7d3595653e1 The package @workleap-ai/shared was found to contain malicious code. Source: ghsa-malware...

MAL-2026-211 Malicious code in @workleap-widgets/client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef0a9fe50f30201e6a1a6a853aa62e6b2b64237598b60ac59e8c74974d8e33ca The package @workleap-widgets/client was found to contain malicious code. Source: ghsa-malware...

MAL-2026-209 Malicious code in @t4i-cms-components/contact-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7daa695b6aa59e8369fb05292fc589bf605f2648c9e66dd008e7c91314bb820e The package @t4i-cms-components/contact-card was found to contain malicious code. Source: ghsa-malware...