Files or Directories Accessible to External Parties

Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties through the Vips analyzer and Vips transformer in vips.rb. An attacker can read files from the server, including process environment variables, by uploading a crafted image and causing...

PT-2026-85880

Package external-secrets-fips version 0.17.0-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

PT-2026-66406

When enabling Spring Boot DevTools support for a remote application target for example a Docker container or Cloud Foundry app from the Spring Tools Boot Dashboard, Spring Tools generates a shared secret that authenticates DevTools remote-restart uploads to the deployed application. This secret w...

PT-2026-86045

Package secrets-store-csi-driver-fips version 1.5.4-r0 fixes 2 vulnerabilities: ghsa-f6x5-jh6r-wrfv, ghsa-j5w8-q4qc-rx2x...

PT-2026-66507

Name of the Vulnerable Software and Affected Versions CSL 1010 M2M 3G WiFi Module versions prior to 2.2.1.5 Description The firmware uses a weak single-byte XOR cipher with a static key to obfuscate the configuration backup file. This allows unauthenticated attackers to reverse the cipher and...

PT-2026-66655

Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secret key base and often credentials for external systems, whic...

CSL 1010 M2M 3G WiFi Module 2.2.1.4 (Router.cfg) Weak XOR Encryption

Summary The CSL 1010 M2M 3G WiFi Module is a portable 3G/LTE router that stores its configuration in a backup file Router.cfg. Description The device protects its configuration file Router.cfg with a weak/insecure obfuscation single-byte XOR cipher using a static key 0xEC instead of real...

Malicious code in @ai-plus/de-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d50f0cb1eb732ea83ae7a1d6ac6b1c20aef7005b9aaac240d43b18a2d0dfe07 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @ai-agent-node/nodesql (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9bd9860fa6b32249720b90f9ba4f48642cbd746fe04e701b05cba6eef2951671 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11171 Malicious code in @ai-agent-node/agent-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8edd22e8454df2a9c10d47ea5c39560f9384598e7fb2a26b26b8f647fd5d2dd1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11172 Malicious code in @ai-agent-node/createnode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88461b4fe3bc4e6e16f6dbabec2dd4acdf4eb2df6390170776629e5f955f13f4 @ai-agent-node/createnode ships a 12-line main module that, on require, fetches https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 owner:...

Malicious code in @zannstore/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 708c069b088fb74064262b95a516de8d4b3f3128bd6705d98ee7e8dc10e942c8 @zannstore/baileys is a fork of the Baileys WhatsApp Web library. A a static rule fired on lib/Utils/generics.js due to keyword co-occurrence of...

MAL-2026-11179 Malicious code in @zannstore/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 708c069b088fb74064262b95a516de8d4b3f3128bd6705d98ee7e8dc10e942c8 @zannstore/baileys is a fork of the Baileys WhatsApp Web library. A a static rule fired on lib/Utils/generics.js due to keyword co-occurrence of...

CVE-2026-16543

Kong Operator's embedded Kong Kubernetes Ingress Controller KIC allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secrets across all watched namespaces using a label selector...

Malicious code in @peptide-unit/js-unimode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4d2db0b951057e42b31006e9bfd3752cde6db494df5959f44e0243f802d7a32 index.js is a repackaged copy of the legitimate emptyport/unimod peptide-modification lookup library with an obfuscator.io RC4 string-array IIFE...

MAL-2026-11177 Malicious code in @peptide-unit/js-unimode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4d2db0b951057e42b31006e9bfd3752cde6db494df5959f44e0243f802d7a32 index.js is a repackaged copy of the legitimate emptyport/unimod peptide-modification lookup library with an obfuscator.io RC4 string-array IIFE...

Malicious code in @peptide-unit/peptide-modify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 057496c38e2475722f55b10253b62536011c6e82e3552f53450fe80441e40c65 No static or behavioral indicators of supply-chain attack were identified in this package version. No lifecycle scripts fetching or executing remote...

Malicious code in uniapi-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09d612d64d0f85043a8a38f0098a520182eada4e67046bdff3bd6bfd8bf150e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in colder-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd07744737c9b6e9ee846d8a15610b53170c6a0fa0937c00251d4b87697bea57 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11189 Malicious code in test-skill-zip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90b0b80c790dd0c39844830b06e5388141ddc9a78aa8e79510cb6cd148de1a63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...