40876 matches found
Malicious code in create-backend-scaffold (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0201b01c3bd9dbea597956acb10299aa22cd7976dcb7863348892f46512b47f1 playground/src/routes/auth.routes.js contains an obfuscated trailer appended after the normal router export. The trailer aliases require/module to...
MAL-2026-11270 Malicious code in create-backend-scaffold (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0201b01c3bd9dbea597956acb10299aa22cd7976dcb7863348892f46512b47f1 playground/src/routes/auth.routes.js contains an obfuscated trailer appended after the normal router export. The trailer aliases require/module to...
SUSE CVE-2026-46617
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.23.0, Fission runtime pods were created with ServiceAccountName: fission-fetcher, and the fission-fetcher ServiceAccount was granted...
SUSE CVE-2026-47190
IPAM is the IP address Manager for Cluster API Provider Metal3. Prior to versions 1.11.7, 1.12.4, and 1.13.0, the IPAM controller's ClusterRole granted full CRUD permissions create, delete, get, list, patch, update, watch on core/v1 Secrets. The controller never accesses Secrets during normal...
SUSE CVE-2026-47671
Nhost is an open source Firebase alternative with GraphQL. In versions of Nhost CLI prior to 1.46.0, the hidden nhost configserver used by nhost dev exposes the Mimir GraphQL API with dummy authorization directives and permissive CORS. When a developer is running the local development environment...
Malicious code in pretty-log-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad32145cb24ae2a271cecb6379d30a531be17d84a0d71189d3a4afaec20af015 No malicious behavior was identified in this package version. There is no evidence of credential access, environment scraping, network exfiltration,...
MAL-2026-11349 Malicious code in pretty-log-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad32145cb24ae2a271cecb6379d30a531be17d84a0d71189d3a4afaec20af015 No malicious behavior was identified in this package version. There is no evidence of credential access, environment scraping, network exfiltration,...
Malicious code in logform-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ec6c47e9e94b571242404a22ce01e255dc1df012c3d13477b5d2db9a96a037c Package name 'logform-core' is one edit/suffix away from the widely-used 'logform' logging-format library, and the README advertises formatting...
MAL-2026-11328 Malicious code in logform-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ec6c47e9e94b571242404a22ce01e255dc1df012c3d13477b5d2db9a96a037c Package name 'logform-core' is one edit/suffix away from the widely-used 'logform' logging-format library, and the README advertises formatting...
Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url
Summary llm.chat reads the operator's provider key from the environment OPENAIAPIKEY, ANTHROPICAPIKEY, ... and sends it in the Authorization: Bearer header to baseurl, a parameter the caller controls. baseurl is only checked against the SSRF guard, and the guard allows any public host, so pointin...
Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted
Summary The capability policy denies the env.get and env.loaddotenv modules by default, with the stated reason that they read arbitrary host environment variables API keys, DSNs and are a secret-exfil risk. But the workflow engine's variable resolver expands $env.VAR for any environment variable...
Malicious code in react-fast-refresh-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcca3ccc0a35a13d8b3f30ff6019ab57782882ada4e01b941fbee77ad1236115 Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json declares a postinstall hook...
burp-ai-agent v0.9.2
Custom AI Agent The bridge between Burp Suite and modern AI. A note on the name: This extension is published as Custom AI Agent formerly Burp AI Agent. It was renamed to comply with PortSwigger's BApp Store naming requirements and to avoid confusion with Burp Suite's built-in Burp AI provider. Th...
camel-vertx-websocket: Apache Camel Vertx Websocket: Server-Side Request Forgery and sensitive data exposure
A flaw was found in the Apache Camel Vertx Websocket component. This vulnerability allows an unauthenticated remote attacker to inject malicious query parameters into a WebSocket connection. This can lead to Server-Side Request Forgery SSRF, where the server is coerced into making requests to...
CLEANSTART-2026-YP94336 Security fixes in external-secrets-operator 2.4.1-r0
Package external-secrets-operator version 2.4.1-r0 fixes 3 vulnerabilities: CVE-2026-32952, ghsa-pjcq-xvwq-hhpj, ghsa-mh2q-q3fh-2475...
CLEANSTART-2026-FP92201 Security fixes in secrets-store-csi-driver-provider-gcp 1.15.0-r1
Package secrets-store-csi-driver-provider-gcp version 1.15.0-r1 fixes 21 vulnerabilities: CVE-2026-39824, CVE-2026-39827, CVE-2026-39828, CVE-2026-39829, CVE-2026-39830...
CLEANSTART-2026-NF83419 Security fixes in sealed-secrets 0.36.1-r0
Package sealed-secrets version 0.36.1-r0 fixes 7 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288...
CLEANSTART-2026-CD20874 Security fixes in external-secrets-operator 2.7.0-r2
Package external-secrets-operator version 2.7.0-r2 fixes 3 vulnerabilities: ghsa-gcjh-h69q-9w9g, ghsa-hrxh-6v49-42gf, CVE-2026-41178...