MAL-2026-4675 Malicious code in supership-scan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aebde5ba55a72b6d4c6917ccf22db1427d434fed04cecc22dd16844e2d39033 The package advertises itself as a local-only static analyzer README: "Runs locally. Your code never leaves the machine" and "What's never transmitte...

CVE-2026-9129

A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can supply a URL-encoded absolute path such as an encode...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: external-secrets-operator, gitlab-runner, crossplane, flux-image-automation-controller, guac, nfpm, pulumi-language-dotnet, kots, src-fingerprint, k9s, kubevela, snyk-cli, act, trivy, zarf, kargo, xeol, wolfictl, argocd-image-updater, tfsec, trivy-operator, argo-cd,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, gitlab-runner, crossplane, flux-image-automation-controller, guac, nfpm, pulumi-language-dotnet, kots, src-fingerprint, k9s, kubevela, snyk-cli, act, trivy, zarf, kargo, xeol, wolfictl, argocd-image-updater, tfsec, trivy-operator, argo-cd,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, gitlab-runner, crossplane, flux-image-automation-controller, guac, nfpm, pulumi-language-dotnet, kots, src-fingerprint, k9s, kubevela, snyk-cli, act, trivy, zarf, kargo, xeol, wolfictl, argocd-image-updater, tfsec, trivy-operator, argo-cd,...

CVE-2026-45570 vulnerabilities

Vulnerabilities for packages: external-secrets-operator, gitlab-runner, crossplane, flux-image-automation-controller, guac, nfpm, pulumi-language-dotnet, kots, src-fingerprint, k9s, kubevela, snyk-cli, act, trivy, zarf, kargo, xeol, wolfictl, argocd-image-updater, tfsec, trivy-operator, argo-cd,...

Malicious code in @ctrl/plex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20e1aad15739a79a359d88099a004fa395b66df8845c10823824e848f095c568 The @ctrl/ npm scope was compromised in the Shai-Hulud supply-chain incident September 2025. Versions of @ctrl/plex published during and after the...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: packer, terragrunt, chainloop-cli-fips, argo-events, amazon-ssm-agent-fips, kots, zarf-fips, gitlab-runner, kubevela-fips, k9s, pulumi, kaniko, packer-fips, trufflehog-fips, flux-fips, skaffold, gptscript, google-osconfig-agent, src-fingerprint-fips, kaniko-fips,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: packer, terragrunt, chainloop-cli-fips, argo-events, amazon-ssm-agent-fips, kots, zarf-fips, gitlab-runner, kubevela-fips, k9s, pulumi, kaniko, packer-fips, trufflehog-fips, flux-fips, skaffold, gptscript, google-osconfig-agent, src-fingerprint-fips, kaniko-fips,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: packer, terragrunt, chainloop-cli-fips, argo-events, amazon-ssm-agent-fips, kots, zarf-fips, gitlab-runner, kubevela-fips, k9s, pulumi, kaniko, packer-fips, trufflehog-fips, flux-fips, skaffold, gptscript, google-osconfig-agent, src-fingerprint-fips, kaniko-fips,...

CVE-2026-9129

A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can supply a URL-encoded absolute path such as an encode...

EUVD-2026-31148

A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can supply a URL-encoded absolute path such as an encode...

CVE-2026-9129 Path Traversal in Altium Enterprise Server Viewer StorageController Allows Arbitrary File Read

A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can supply a URL-encoded absolute path such as an encode...

CVE-2026-9129 Path Traversal in Altium Enterprise Server Viewer StorageController Allows Arbitrary File Read

A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling of file path route parameters. On on-premise deployments that use local filesystem storage, a regular authenticated user can supply a URL-encoded absolute path such as an encode...

CVE-2026-9129

The CVE-2026-9129 entry concerns Altium Enterprise Server Viewer StorageController. On on‑prem deployments using local filesystem storage, an authenticated user can supply a URL-encoded absolute path in a Viewer storage API request, causing the storage root to be discarded and enabling arbitrary ...

Malicious code in iv-stubborn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b8934157781e3457974f0609c54f14503424c9077b316f2e8e843e454989922 On npm install, both preinstall and postinstall lifecycle hooks execute index.js, which collects the installer's hostname, all non-internal network...

Malicious code in @doctolib-apps/native-personalized-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac2da4b8de2ea081f8fe7b84ef6182ab363616dc0515aaa03368bcba4a4b8e76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-4191 Malicious code in iv-bloomfilter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7f2a3b58036e1174efe383ee906172b07f9ddc3410d913e51b4e614f9ff09ee Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-4186 Malicious code in @doctolib-apps/native-personalized-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac2da4b8de2ea081f8fe7b84ef6182ab363616dc0515aaa03368bcba4a4b8e76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-4192 Malicious code in iv-stubborn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b8934157781e3457974f0609c54f14503424c9077b316f2e8e843e454989922 On npm install, both preinstall and postinstall lifecycle hooks execute index.js, which collects the installer's hostname, all non-internal network...