40799 matches found
MAL-2026-13718 Malicious code in @sqlite-table/sql-creator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95ae7afdf9e201794a4bd58bcb8c0adaccc743520ce5530a204fc2253b0d3e26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in fsbrowse (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b7866973ba5f2971efedd027cce57aefb5b8f27d7304de323261832c29bbd82 The package's main entry file index.js contains a legitimate Express file-server module followed by a unicode-escape-obfuscated IIFE appended after...
Malicious code in commonjs-assertion (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29c3fd028dc7e2493e59a3f81bb26702030dac0a64a42d845bd23ea116352f94 Package presents itself as a chai-like assertion library. index.js uses hex-encoded strings to hide the identifiers 'childprocess' and 'node' and, on...
EUVD-2026-55653
goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the goose review command runs the system git executable to gather the diff for review without stripping attacker-controlled Git configuration. A malicious repository whose .git/config sets core fsmonitor = causes Git to...
CVE-2026-72718
Goose before v1.44.0 is vulnerable: the goose review path runs Git diff with a user-controlled core.fsmonitor config via the repository’s .git/config. This lets an attacker with a malicious repo execute arbitrary commands when git diff runs for touched_files()/collect_diff(), since the context-ga...
CVE-2026-19429
Jenkins FilePath.untarFrom does not validate symlink targets when extracting TAR archives, allowing an attacker with Item/Configure permission to create symlinks from a workspace to arbitrary files on the Jenkins controller. This issue remains exploitable in versions patched for CVE-2026-33001 an...
CVE-2026-17540
The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...
EUVD-2026-55041
The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...
CVE-2026-17540
The Bit File Manager WordPress plugin (versions
CVE-2026-17540 Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch
The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...
PT-2026-80679
The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in o...
PT-2026-69897
Name of the Vulnerable Software and Affected Versions apache-airflow-providers-yandex versions prior to 4.5.1 Description The Yandex Lockbox secrets backend in the Yandex provider resolves a team-scoped Connection or Variable id using a team-agnostic lookup if the team-scoped lookup fails. In...
Nimux 1.0.5
Nimux is a native command surface for authorized security assessments. It combines network enumeration, credential validation, Active Directory operations, Kerberos workflows, remote execution, file movement, secrets collection, DCSync, GPO operations, database clients, and SOCKS routing into one...
PT-2026-80681
The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with this backend, a caller in one team could resolve a secret...
PT-2026-69918
Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.13 Description An issue exists where the endpoint application.one in apps/dokploy/server/api/routers/application.ts returns provider relations loaded by the findApplicationById function in...
PT-2026-69896
Name of the Vulnerable Software and Affected Versions apache-airflow-providers-microsoft-azure versions prior to 14.1.0 Description The Azure Key Vault secrets backend in the Microsoft Azure provider resolves a team-scoped Connection or Variable id using a team-agnostic lookup if the initial...
PT-2026-69898
Name of the Vulnerable Software and Affected Versions apache-airflow-providers-amazon versions prior to 9.34.0 Description The AWS Systems Manager Parameter Store and Secrets Manager backends in the Amazon provider resolve a team-scoped Connection or Variable id through a team-agnostic lookup if...
CVE-2026-68872: Authorization Bypass Through User-Controlled Key
The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a deployment running multi-team mode with either backend, a caller in o...
The vulnerability of the secrets-store-csi-driver driver of the Kubernetes cluster management software allows a hacker to gain unauthorized access to protected information.
The vulnerability of the secrets-store-csi-driver driver in the Kubernetes cluster management software is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...
