EUVD-2026-53528

A cross-site request forgery CSRF vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins...

Malicious code in stellarfixer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd3a96aa989ed6cadd106e8e7d04317ea30f83434a40eabc307578cb0690b78f On npm install, the package's postinstall script unconditionally executes a bundled Windows PE at bin/stellarfn.exe via execFileSync. The binary is...

Malicious code in trailserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93c4162f378d4eac522f50de4af9ac836cd0ec727ea90a33633a3cd36e29211e The package's declared main entry launcher.js invokes launch at top level, so require'trailserver' triggers system-level installation of Python via...

MAL-2026-12484 Malicious code in trailserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93c4162f378d4eac522f50de4af9ac836cd0ec727ea90a33633a3cd36e29211e The package's declared main entry launcher.js invokes launch at top level, so require'trailserver' triggers system-level installation of Python via...

MAL-2026-12502 Malicious code in gcli-control (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8bd4de0b73d7df676127ce8c632117fc7ea8d008bf941fb7d385f67a84f8d67 The package installs and runs a host daemon python -m gcli host that polls a shared JSON document at api.npoint.io for commands, decrypts them,...

Malicious code in gcli-control (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8bd4de0b73d7df676127ce8c632117fc7ea8d008bf941fb7d385f67a84f8d67 The package installs and runs a host daemon python -m gcli host that polls a shared JSON document at api.npoint.io for commands, decrypts them,...

MAL-2026-12180 Malicious code in geocode-quick (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f8f109952f61867c1ca8819f7a151b89de305ff4b157f49400ef4428019419 The package advertises itself as a geocoding CLI but, on every invocation of the tool, executes env via execFile to dump the full process environment...

MAL-2026-12190 Malicious code in retracfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7656b934d52c542162613f35aa909400f46aa0dae186ef9d55667f048bdfdcd4 The npm package [email protected] ships with no documented functionality empty description, no README, no source, no dependencies and consists only of...

Malicious code in stellarfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa63d1cc5db1027ec89a76a75db2e765cc0c951ca8b5324ac4ec9ef3e849d325 stellarfix ships a.NET Windows executable at bin/stellarfn.exe and a postinstall.js that enumerates bin/.exe and unconditionally launches the first o...

MAL-2026-12118 Malicious code in @zzzgenesis00/bitcoin-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 742be73b4f635f669a2c8191ddc90c46150e9d92ca432e5045c570fc0163f439 @zzzgenesis00/bitcoin-lib 6.1.7 runs a postinstall.js at npm install time that harvests installer-owned secrets and exfiltrates them to...

Malicious code in @wethenorth12/near-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec76b158cd4b27bb2e90a492c1713c1655dcbd2f4a9fc0f03a0664d8bec8e2ed Package @wethenorth12/near-api is presented as a 'drop-in replacement' for near-api-js and falls back to require'near-api-js' if installed. On requir...

PT-2026-68270

Name of the Vulnerable Software and Affected Versions Jenkins SCM-Manager Plugin versions prior to 1.11.2 Description A missing permission check allows users with Overall/Read permission to force the system to connect to an arbitrary URL. By providing a specific URL and credentials IDs obtained...

CVE-2026-9190: Inconsistent Interpretation of HTTP Requests

An HTTP request smuggling vulnerability in the HTTP App Server of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker to bypass authentication and authorization checks, hijack a legitimate user's session, or capture credentials. The vulnerability occurs when a crafted HTTP...

PT-2026-68277

Name of the Vulnerable Software and Affected Versions Jenkins Google Chat Notification Plugin versions prior to 166.ve6b de280f2e8 Description The plugin fails to set the appropriate context for credentials lookup. This allows attackers who possess Item/Configure permissions to access and capture...

PT-2026-68218

Name of the Vulnerable Software and Affected Versions Progress MarkLogic Server versions prior to 11.3.6 Progress MarkLogic Server versions prior to 12.0.3 Description An HTTP request smuggling issue exists in the HTTP App Server. This occurs when a crafted HTTP request containing both...

PT-2026-68269

Name of the Vulnerable Software and Affected Versions Jenkins SCM-Manager Plugin versions prior to 1.11.2 Description A cross-site request forgery CSRF flaw allows attackers to force the system to connect to an external URL using specific credentials IDs. This can lead to the capture of credentia...

CVE-2026-70442: Improper Authorization

Jenkins Google Chat Notification Plugin 166.ve6bde280f2e8 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access and capture credentials they are not entitled to use...

SUSE SLES15 Security Update : nginx (SUSE-SU-2026:3469-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3469-1 advisory. This update for nginx fixes the following issue: - CVE-2026-42533: referencing regex capture variables before map output variables can trigg...

Important: nginx

Issue Overview: A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a...

FreeBSD : Angie -- multiple vulnerabilities (347fe124-8f53-11f1-9f4f-3c7c3fba4204)

"The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 347fe124-8f53-11f1-9f4f-3c7c3fba4204 advisory. The Angie Software Team reports: When evaluating a string expression in which unnamed capture...