Malicious code in redeem-onchain-sdk (npm)

redeem-onchain-sdk is a malicious npm package impersonating a Polymarket on-chain SDK. It collects SSH keys, AWS credentials, .npmrc tokens, Docker auth, Chrome saved logins, .env files, and a month of git commit history, then ships everything over a raw TCP socket to an AWS-hosted C2. Two trigge...

Malicious code in apple-internal-auth-v3 (npm)

Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Apple internal infrastructure services authentication, PKI, telemetry, CloudKit, and cloud infrastructure. All packages in this campaign execute credential-theft payloads durin...

MAL-2026-3152 Malicious code in apple-coredata-internal-service (npm)

Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Apple internal infrastructure services authentication, PKI, telemetry, CloudKit, and cloud infrastructure. All packages in this campaign execute credential-theft payloads durin...

EUVD-2026-25921

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Conten...

CVE-2026-7191

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Conten...

CVE-2026-7191 Arbitrary Code Execution via Sandbox Bypass in the open source solution QnABot on AWS

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Conten...

PT-2026-35526

Name of the Vulnerable Software and Affected Versions qnabot-on-aws versions prior to 7.3.0 Description Improper use of the static-eval npm package allows an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context. This is achieved by injecting a...

CVE-2026-7191: Improper Control of Generation of Code

Improper use of the static-eval npm package in the open source solution qnabot-on-aws versions 7.2.4 and earlier may allow an authenticated administrator to execute arbitrary code within the fulfillment Lambda execution context by injecting a crafted conditional chaining expression via the Conten...

GHSA-QR4G-8HRP-C4RW vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno...

CVE-2026-41485 vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno...

GHSA-CVQ5-HHX3-F99P vulnerabilities

Vulnerabilities for packages: kyverno-notation-aws, kyverno...

GHSA-CVQ5-HHX3-F99P vulnerabilities

Vulnerabilities for packages: kyverno-fips, kyverno-notation-aws-fips, commercial-kyverno, kyverno-notation-aws, kyverno...

CVE-2026-41485 vulnerabilities

Vulnerabilities for packages: kyverno-fips, kyverno-notation-aws, kyverno, kyverno-notation-aws-fips...

GHSA-QR4G-8HRP-C4RW vulnerabilities

Vulnerabilities for packages: kyverno-fips, kyverno-notation-aws-fips, commercial-kyverno, kyverno-notation-aws, kyverno...

aws-client (>=0.10.0, <=0.11.0), git-repo (>=1.7.0, <=1.7.1) potentially affected by CVE-2026-42284 via gitpython (2.0.6)

gitpython PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - aws-client =0.10.0, =1.7.0, =1.7.1 Source cves: CVE-2026-42284 Source advisory: OSV:GHSA-X2QX-6953-8485...

CVE-2026-29181 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-servicediscovery, kubernetes-csi-driver-nfs, percona-xtradb-cluster-operator, prometheus-fips, kserve-modelmesh-serving, kubernetes-csi-node-driver-registrar-fips, kubevirt-cdi-controller, crossplane-provider-aws-cloudfront-fips,...

CVE-2026-32952 vulnerabilities

Vulnerabilities for packages: teleport, gitlab-runner, flux, sftpgo-plugin-auth, telegraf, external-secrets-operator, trufflehog, cert-manager-csi-driver, rclone, nuclei, grafana, percona-server-mongodb-operator, zot, frp, cert-manager-istio-csr, dex, minio, kyverno-notation-aws, kyverno, spqr,...

GHSA-PJCQ-XVWQ-HHPJ vulnerabilities

Vulnerabilities for packages: teleport, gitlab-runner, flux, sftpgo-plugin-auth, telegraf, external-secrets-operator, trufflehog, cert-manager-csi-driver, rclone, nuclei, grafana, percona-server-mongodb-operator, zot, frp, cert-manager-istio-csr, dex, minio, kyverno-notation-aws, kyverno, spqr,...

CVE-2026-6911 Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel

Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the application, including the ability to read, modify, and delete all application data across tenants and manage Cognito user accounts within the...

CVE-2026-6911

Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the application, including the ability to read, modify, and delete all application data across tenants and manage Cognito user accounts within the...