MAL-2026-6692 Malicious code in polymarket-trading-developer-tools (npm)

Malicious npm package published as part of a coordinated DeFi-themed infostealer campaign targeting Polymarket developers. polymarket-trading-developer-tools uses a dropper technique: a postinstall hook downloads configuration from pm-trading-dev-tools-be.vercel.app and exfiltrates data to the...

PYSEC-2026-384 Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise

Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acmeurl SSRF and creator-equality IDOR Vulnerability Summary Field | Value -- | -- Title | Lemur 1.9.0: any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via...

PYSEC-2026-339 FireFighter has unauthenticated SSRF in its Raid jira_bot endpoint that allows IAM credential theft

Impact The POST /api/v2/firefighter/raid/jirabot endpoint CreateJiraBotView is reachable without authentication permissionclasses = permissions.AllowAny. Its attachments payload is fetched server-side via httpx.get with no URL validation, then uploaded as an attachment on the Jira ticket that get...

MAL-2026-6551 Malicious code in anthropic-internal-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab3bb04aee6f5f1d8768b7fd2173cd7c0cac18b5d83d6a83cf2be96a7512d8f7 Package name impersonates the Anthropic namespace and ships a preinstall hook scripts.preinstall = 'node index.js' that executes on every npm install...

SUSE SLES15 Security Update : aws-iam-authenticator (SUSE-SU-2026:2643-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2643-1 advisory. This update for aws-iam-authenticator fixes the following issues - CVE-2022-1996: CORS bypass bsc1200528. - CVE-2022-2385:...

CVE-2026-48702 vulnerabilities

Vulnerabilities for packages: cloudbeat, kubescape, tflint-fips, ko-fips, neuvector-sigstore-interface, tkn, crossplane-fips, kyverno, tbot, tekton-chains-fips, trivy-operator, teleport, ratify, falcoctl, aactl, ko, policy-controller, kubescape-server, kyverno-fips, tekton-chains,...

GHSA-47Q9-M4WW-924M vulnerabilities

Vulnerabilities for packages: cloudbeat, kubescape, tflint-fips, ko-fips, neuvector-sigstore-interface, tkn, crossplane-fips, kyverno, tbot, tekton-chains-fips, trivy-operator, teleport, ratify, falcoctl, aactl, ko, policy-controller, kubescape-server, kyverno-fips, tekton-chains,...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: mattermost-fips, kube-state-metrics, traefik-fips, nerdctl, commercial-expanso-edge, trivy-operator, omnictl-multiarch-fips, traefik, frankenphp-8.4, harbor-fips, kubescape-server, kyverno-fips, snyk-cli, keda-fips, gitlab-workhorse-ce-fips, opentofu-fips, zitadel,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-opensearch-fips, kube-state-metrics, kyverno-policy-reporter-plugins-kyverno-fips, nerdctl, commercial-expanso-edge, crossplane-provider-azure-authorization, trivy-operator, rootlesskit-fips, crossplane-provider-aws-s3control-fips,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: telegraf, pulumi, docker, gptscript, prometheus-operator, external-dns, sops, wolfictl, gomplate, trivy-operator, mattermost, kaf, step-kms-plugin, kubernetes, kubescape, terraform-provider-azurerm, kots, opentelemetry-collector, tflint, gh, ksops, cilium-cli,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: telegraf, chisel, loki, containerd, k3s, cert-manager, prometheus-operator, kubernetes-dashboard, external-dns, rancher, gitlab-kas, argocd-image-updater, knative-serving, prometheus, trivy-operator, mattermost, snyk-cli, kaf, kyverno, zarf, flux, kubernetes,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: telegraf, pulumi, gptscript, prometheus-operator, external-dns, wolfictl, gomplate, trivy-operator, mattermost, kaf, step-kms-plugin, kubernetes, kubescape, kots, opentelemetry-collector, cilium-cli, istio, step-issuer, syft, docker-cli-buildx, knative-serving, zot,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: telegraf, loki, containerd, k3s, buildah, cert-manager, podman, prometheus-operator, kubernetes-dashboard, external-dns, rancher, gitlab-kas, knative-serving, prometheus, mattermost, snyk-cli, kaf, kyverno, flux, kubernetes, kots, zot, opentelemetry-collector,...

Security update for aws-iam-authenticator

This update for aws-iam-authenticator fixes the following issues CVE-2022-1996: CORS bypass bsc1200528. CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass bsc1201395. CVE-2024-39689: remove root certificates from GLOBALTRUST from the root store. CVE-2025-47910: net/http:...

SUSE-SU-2026:2643-1 Security update for aws-iam-authenticator

This update for aws-iam-authenticator fixes the following issues - CVE-2022-1996: CORS bypass bsc1200528. - CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass bsc1201395. - CVE-2024-39689: remove root certificates from GLOBALTRUST from the root store. - CVE-2025-47910: net/http:...

GO-2026-5601 AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance in github.com/aws/aws-advanced-go-wrapper/auth-helpers

AWS Advanced Go Wrapper has Privilege Escalation in Aurora PostgreSQL instance in github.com/aws/aws-advanced-go-wrapper/auth-helpers. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

MAL-2026-6486 Malicious code in unsafe-malicious-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3579cb796e48f446b07e2dbbce2e301d1a3e87d8a9a35ed1dbe825fc53f29da9 On npm install, the package's postinstall lifecycle script scripts/postinstall.js reads the installer's AWS credentials file at /.aws/credentials and...

MAL-2026-6432 Malicious code in rstreams-metrics (npm)

The rstreams-metrics npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

MAL-2026-6418 Malicious code in leo-aws (npm)

The leo-aws npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

MAL-2026-6422 Malicious code in leo-config (npm)

The leo-config npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...