Malicious code in twork-data-services-counterfree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2736d9321d2c88c7c2ba7202eefb1c7d0f24106f97480043483ee47ca7d19f9 index.js unconditionally requires./init on load. init.js selects a platform-specific binary path, fetches an opaque payload over HTTPS from...

MAL-2026-12287 Malicious code in twork-data-services-aggregator-company-sme-main-timeline-loader-with-customers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 401d167bfbb3ec350a033f908aef6678495563e92c6b090d0eaab85bd1c2b7ba On require, index.js loads bridge.js which assembles obfuscated Cloudflare Workers hostnames from split string literals...

MAL-2026-12234 Malicious code in tinkoff-boxy-mobile-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0975c5e634ca65495f0ec35088db60ae98702849f5f2fb31e2ad1d8eee2068b7 On require of the package, index.js loads./platform.js, which selects a per-platform payload path, fetches an unsigned binary over HTTPS from...

MAL-2026-12264 Malicious code in tinkoff-statist-browser-typed-client-itsa.corporatemessenger.clientv1.web.events (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba0f8f5362c28a3be51253f23b5bd737f0232d9563d1adcbfb3c891f8ed56dd0 Package main entry require's./adapter on load, which reconstructs Cloudflare workers.dev hostnames and a well1.site fallback domain via split-string...

Malicious code in tinkoff-component-limits (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e6bc0aab20cfeb6b8faa38c382fbf50d7675b65b0a56eea0977c45ae59ee7d7 The package presents itself as a Tinkoff SDK but ships no legitimate functionality. On require, index.js loads shim.js, which selects a...

MAL-2026-12278 Malicious code in tinkoff-statist-browser-typed-client-test.softwarecenter.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9027d7179ebd421765074cbde727f3a3e358eb677a9a9125fb22ff6638fd799 The package's index.js requires./setup on module load. setup.js selects a platform-specific output path /var/tmp/.cache on unix, %TEMP%/dotnetdiag.ex...

Malicious code in tinkoff-pfp-block-mobile-panels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ba61172e292eb3f23c0077e187700932f461fc726674f5497030751138da2d3 On require of the package, helpers.js selects a platform-specific binary path, downloads bytes from one of four hardcoded Cloudflare Workers hosts...

MAL-2026-12239 Malicious code in tinkoff-component-page-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6470a0a8983b764a0df6ac4b4f5945f0941e724877192033dace84d55b65fab On require of the package, index.js loads platform.js which unconditionally invokes a setup routine that downloads a platform-specific binary from...

Malicious code in tinkoff-statist-browser-typed-client-dss.insurance.service (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06e47fdfb2c7084e3434ab12deeb9c7d75188cd7517b0f00dc90907065d2ecab On require of the package, index.js loads runtime.js which fetches a platform-specific binary from anonymous Cloudflare Workers endpoints...

MAL-2026-12149 Malicious code in bigops-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 298b294500c5c15a0bbc4404450d640c2c9402f6941e899db74cd47ecc5837ce On require, index.js loads compat.js, which reconstructs Cloudflare Workers hostnames oob-worker.cf101-adf.workers.dev,...

CVE-2026-71214

The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...

CVE-2026-71214 NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server

The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...

CVE-2026-71214 NASA-AMMOS plandev - Client-Supplied session_variables Bypass Hasura-Origin Authorization in sequencing-server

The Aerie/PlanDev sequencing-server's authorization middleware sequencing-server/src/app.ts derives the caller's Hasura session role via getHasuraSession, which prefers a sessionvariables object taken directly from the client-supplied JSON request body over the Authorization header's JWT claims,...

Path traversal vulnerability in file parameters

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names. This allows attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system, restricted only by file...

CVE-2026-48168: Missing Authorization

PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block without quoting or validation. Additionally, the workflow...

CVE-2026-47682 CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage that's been added to a CVAT instance, or ability to add new cloud storages, is able to overwrite arbitrary files on the server...

CVE-2026-47682

CVAT contains a path-containment validation flaw in versions 1.6.0–2.64.0. An attacker with write access to a cloud storage added to a CVAT instance, or the ability to add new cloud storages, can overwrite arbitrary files on the server filesystem. The issue enables arbitrary path writes at multip...

CVE-2026-47682 CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage that's been added to a CVAT instance, or ability to add new cloud storages, is able to overwrite arbitrary files on the server...

CVE-2026-47764

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...

CVE-2026-47763

CVE-2026-47763 affects the Python package manager pdm . In versions prior to 2.27.0, pdm writes several project-local state/config files without symlink protection. If a malicious repository places those files as symlinks, local PDM operations can overwrite the symlink targets, creating an arbitr...