CVE-2026-54465

A flaw was found in websocket-driver, a WebSocket protocol handler. A remote attacker can exploit this vulnerability by sending an HTTP request or response with a never-ending list of headers to a server or client using websocket-driver. This can cause the receiving process to consume an unbounde...

CVE-2026-18276

CVE-2026-18276 affects Scripta eScriptorium prior to 26.04.1 due to missing authorization in the websocket consumer. A remote authenticated user can subscribe to any document’s event stream and observe another user’s segmentation, transcription, import, export, and training activity by manipulati...

CVE-2026-18276 Missing Authorization in eScriptorium

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...

EUVD-2026-54089

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...

CVE-2026-18276 Missing Authorization in eScriptorium

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...

Malicious code in @love-moon/conductor-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ea5d4f1af0a0b67e6f74bfb45867ce0b33136083138e3c23a56df03d8b5c902 The conductor daemon command bin/conductor-daemon.js - src/daemon.js opens a WebSocket to https://conductor.conductor-ai.top or a user-configured...

MAL-2026-13428 Malicious code in @love-moon/conductor-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ea5d4f1af0a0b67e6f74bfb45867ce0b33136083138e3c23a56df03d8b5c902 The conductor daemon command bin/conductor-daemon.js - src/daemon.js opens a WebSocket to https://conductor.conductor-ai.top or a user-configured...

Malicious code in @bananacool467/ui-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8497bfe55fd379ac7c87c73e99e8c532193a17516996d9ae6cfb856b84a052a The package advertises itself as a UI-components library README compares it to MUI, but its main export surface includes useTerminal, a server-side...

MAL-2026-13416 Malicious code in @bananacool467/ui-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8497bfe55fd379ac7c87c73e99e8c532193a17516996d9ae6cfb856b84a052a The package advertises itself as a UI-components library README compares it to MUI, but its main export surface includes useTerminal, a server-side...

Malicious code in @ccfly/setup-linux-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33138ee17148f975a7c0b34f5d6ee1a4ad082395b87872dc91de0778130b91c8 The tarball ships a single 6.9 MB linux/x64 Go executable at bin/ccfly-setup and no source. The binary links github.com/creack/pty PTY spawning and...

MAL-2026-13418 Malicious code in @ccfly/setup-linux-x64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33138ee17148f975a7c0b34f5d6ee1a4ad082395b87872dc91de0778130b91c8 The tarball ships a single 6.9 MB linux/x64 Go executable at bin/ccfly-setup and no source. The binary links github.com/creack/pty PTY spawning and...

MAL-2026-13417 Malicious code in @ccfly/setup-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector faefd7405c377b2260ca4d731c9234a294d8d07b559646b8fc58be5488906eec The package ships a 6.3 MB linux/arm64 Go binary at bin/ccfly-setup. The binary embeds github.com/creack/pty PTY spawner and...

Malicious code in @aubea/mars (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdc44d9f879ce07c857e122c24664d6ae0445cb55aceeeb12c898d65898f7617 When invoked as its CLI npx @aubea/mars, the package opens a WebSocket connection to a hardcoded third-party relay at wss://cho100.cn/mars-relay and...

MAL-2026-13415 Malicious code in @aubea/mars (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdc44d9f879ce07c857e122c24664d6ae0445cb55aceeeb12c898d65898f7617 When invoked as its CLI npx @aubea/mars, the package opens a WebSocket connection to a hardcoded third-party relay at wss://cho100.cn/mars-relay and...

Malicious code in 9remote (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4160b2e2774d56c9e7373db28a4073d456248d0fe9b55979fa507f0910b65ce0 9remote is a remote-shell tool: its CLI launches an HTTP/WebSocket server and provisions a Cloudflare Quick Tunnel that exposes the host to the publi...

MAL-2026-13406 Malicious code in 9remote (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4160b2e2774d56c9e7373db28a4073d456248d0fe9b55979fa507f0910b65ce0 9remote is a remote-shell tool: its CLI launches an HTTP/WebSocket server and provisions a Cloudflare Quick Tunnel that exposes the host to the publi...

Malicious code in @xiaohhhh1/canvas-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a34add291ef7584aec7041449cb2e80d36ae98f93c2725e1aa018707e3334119 On bin start, @xiaohhhh1/canvas-agent opens an outbound WebSocket to the hardcoded relay wss://canvas.xiaohhhh1.com/api/agent-relay and treats inboun...

Malicious code in agenthub-multiagent-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca33b55b94f99f1de3d4b34ee5fc42941013cc5ab1f94dce49b6cc0bed5eaa9a agenthub-multiagent-mcp ships a worker dist/worker.js that opens a WebSocket to the hardcoded server wss://agenthub.contetial.com/ws/workers/ and, fo...

MAL-2026-13399 Malicious code in agenthub-multiagent-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca33b55b94f99f1de3d4b34ee5fc42941013cc5ab1f94dce49b6cc0bed5eaa9a agenthub-multiagent-mcp ships a worker dist/worker.js that opens a WebSocket to the hardcoded server wss://agenthub.contetial.com/ws/workers/ and, fo...

CVE-2026-18276: Missing Authorization

Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the objectcls and objectpk values...