Exploit for Eval Injection in Langflow

CVE-2026-33017 Langflow RCE ★ CVE-2026-33017 Langflow Remote...

CVE-2026-75569

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

EUVD-2026-63087

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build...

CVE-2026-76139 Acm-operator-bundle: acm-operator-bundle: bundle build execs unpinned stolostron/release@master with full build credentials

A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and registry passwords, used in the build...

CVE-2026-75569 Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

CVE-2026-75569 Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

EUVD-2026-63086

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

CVE-2026-75569

mce-operator-bundle (Red Hat) contains a build-time supply chain flaw: the bundle-generation process fetches business logic from the mutable branch stolostron/release@master without commit pinning or signature verification. An attacker with write access to that remote repository can inject arbitr...

MAL-2026-14226 Malicious code in animate-css-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d6c86a03c6106e799d0817676fcc92f022b64790aab209aa9fe663c085c4e6 plugin.js contains an RC4/base64 string-array obfuscated function invoked from the exported createPlugin factory. When a consumer's build instantiate...

PT-2026-78701

Name of the Vulnerable Software and Affected Versions mce-operator-bundle affected versions not specified Description The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning fixing a specific version of a commit or...

CVE-2026-75569: Reliance on Insufficiently Trustworthy Component

A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute...

CVE-2026-75926 Hugo 0.162.0 to 0.164.x - Node Permission Model Bypass via Default TailwindCSS Child-Process Grant

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory. Hugo 0.162.0 added tailwindcss to the AllowChildProcess default in...

AWS CodeBuild Build Spec - Exposure Detection

Detected the presence of the AWS CodeBuild buildspec.yml file. This file contains build commands and settings that may disclose sensitive information about the application's build process and infrastructure. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the presence of the AWS CodeBuild...

CVE-2026-58404

A flaw was found in Hugo, a static site generator. The default security policy intended to deny requests to loopback, internal, and cloud-metadata IPv4 addresses could be bypassed. This occurred because the deny rule only matched dotted-decimal notation, allowing alternate IPv4 encodings integer,...

Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container

Summary Nuclio Dashboard exposes POST /api/functions without authentication by default NOP auth mode. The spec.handler field e.g., mymodule:myfunction is parsed by functionconfig.ParseHandler which splits on : only — no path validation is applied to the module portion. During function build,...

Cleartext Storage of Sensitive Information in Memory

Overview Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in Memory in the Build process. An attacker can recover sensitive cryptographic material by reading process memory through methods such as core dumps, swap files, or memory scraping. Remediatio...

Malicious code in animatecss-postcss-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6be12cec08d0999c157774b746c3e431825ae61635bb8ddddf36061d4602cec7 [email protected] ships a tiny PostCSS plugin factory whose body contains an obfuscator.io-style string-array + RC4 decoder functions...

@a1st/aix (>=0.0.3, <=0.8.0), @a1st/aix-core (>=0.2.0, <=0.8.0) +18 more potentially affected by CVE-2026-54298 via astro (>=6.0.0-beta.1, <=6.4.4)

astro NPM version =6.0.0-beta.1, =0.0.3, =0.2.0, =1.11.1, =2.7.0, =0.3.0, =1.4.1, =0.19.0, =0.19.0, =1.10.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-54298 Source advisory: OSV:GHSA-JRPJ-WCV7-9FH9...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the pbjs static code generation. An attacker can execute arbitrary code by providing crafted schema names that are incorporated into generated JavaScript output, which is then executed or imported by the...

CVE-2026-44594

esm.sh is a no-build content delivery network CDN for web development. In 137 and earlier, a Local File Inclusion LFI vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return...