MAL-2026-15562 Malicious code in test-in-one (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4834c80d92d51ee12f73395ddc87c681baf4f911c6bbec54a9110cc55a9c4ae9 The package declares a local file: dependency detector at file:.yalc/detector whose postinstall script src/scripts/check.js executes automatically on...

CVE-2026-82262

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

SUSE CVE-2026-80639

In the Linux kernel, the following vulnerability has been resolved: cxl/test: Fix fortifypanic Fix a runtime assertion in setupxormapping. Fortify complains that it is potentially overflowing the xormaps array per countedbynrmaps. Quiet the false positive by initializing @nrmaps earlier. memcpy:...

CVE-2026-82262 Logto Server-Side Request Forgery via webhook test endpoint

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

CVE-2026-82262

Logto through 1.42.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the POST /api/hooks/:id/test endpoint. The endpoint accepts arbitrary URLs without host validation, allowing tenant administrators holding Management API tokens to issue HTTP POST requests to internal services on ...

CVE-2026-82262 Logto Server-Side Request Forgery via webhook test endpoint

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

CVE-2026-82262 Logto Server-Side Request Forgery via webhook test endpoint

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

CVE-2026-82262

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

EUVD-2026-67793

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

MAL-2026-15286 Malicious code in secure-test-browser-4kquugfg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 267296c85db061ed9eb03ab46b3d2609ac8f3672f2e2b1000eb5c4128c182523 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15278 Malicious code in secure-test-browser-3a1zujw0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5eafb9932b14de66aa15f9850f0b8ef19f5964c521886d08812c9d883f68016f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15471 Malicious code in secure-test-browser-zufp4hzx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3584ec9f6e16770b1c8630b232add013816916ad9006635b584ae3995a64f6e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15460 Malicious code in secure-test-browser-yp88o07w (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fcdde9a08c190c554d2681d2eb758290d0c6f58d3cb7b4504cb1c9502d893fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15400 Malicious code in secure-test-browser-nxottb5j (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29a89a6eb548cd54a4b641ba83437462950bb294ae1dd7faed2256b82dc79806 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15343 Malicious code in secure-test-browser-fmbp7grs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b32906cd1ade3459db84948bdf7e7dd0923b56faa35cc21d723d54bc5b15fa5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-3a1zujw0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5eafb9932b14de66aa15f9850f0b8ef19f5964c521886d08812c9d883f68016f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15317 Malicious code in secure-test-browser-bph71q7u (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ba1ffa1c0eaf6f918e2b77fd4ae5eacf0b90084f53d0024f671079e03479197 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-fmbp7grs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b32906cd1ade3459db84948bdf7e7dd0923b56faa35cc21d723d54bc5b15fa5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-nxottb5j (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29a89a6eb548cd54a4b641ba83437462950bb294ae1dd7faed2256b82dc79806 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-ig1r2teb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 872d4c4e38285c56113d7e681ce70c1a9cfbe69f9297ecab60387b6db8b526be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...