12609 matches found
MAL-2026-4456 Malicious code in @thesignup/cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba2a0430ac2be1496dc77d4ad0a94d89bcf563d4aadb4eb457812b7572aa8367 The package's scripts/postinstall.cjs runs at install time and performs host reconnaissance hostname collection, ping/network probing and posts the...
Malicious code in @ikyyofc/gemini-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5793a1cde3de83b8c15b49a0f9981d72fbf431067a4416ce6b2bd5650ea4a4d6 @ikyyofc/[email protected] ships two heavily obfuscated modules src/gemini.js and src/utils/proxy.js wrapped in an obfuscator.io-style string-array +...
Malicious code in ganache-cli-provider (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 144bbaf975156b3114f5526a7e9a8ffbe8eb411a541c7e457b7bf444200a02c5 Package name impersonates the widely-used ganache-cli Ethereum development tool but ships only a 138-byte index.js stub that wraps...
Fortinet FortiAP operating system command injection vulnerability (CNVD-2026-25589)
Fortinet FortiAP is a controller developed by the American company Fortinet, used for managing wireless access point devices. There are vulnerabilities related to operating system command injection in Fortinet FortiAP and FortiAP-W2. These vulnerabilities stem from improper neutralization of...
OPENSUSE-SU-2026:10827-1 oci-cli-3.83.0-1.1 on GA media
These are all security issues fixed in the oci-cli-3.83.0-1.1 package on the GA media of openSUSE Tumbleweed...
Malicious code in aurapro-ui (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cace553d74971e3660a0a7095662488f531348ba3e756696da5ff0ef9645ab22 The PyPI package aurapro-ui installs its code under the Python import namespace openwebui/ and registers two console scripts in entrypoints.txt —...
alvin-cli (>=1.3.0rc1, <=1.3.0), openmetadata-sqllineage (>=1.1.0.2, <=1.1.0.3) +1 more potentially affected by CVE-2026-46373 via sqlfluff (2.1.2)
sqlfluff PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - alvin-cli =1.3.0rc1, =1.1.0.2, =1.1.0.3 - sqlfluff-templater-dbt 2.1.2 Source cves: CVE-2026-46373 Source advisory: OSV:GHSA-WMHF-FQC8-VXHH...
odd-cli (>=0.1.1, <=0.1.10), odd-collector-sdk (>=0.2.4, <=0.3.56) +4 more potentially affected by CVE-2026-46373 via sqlfluff (3.0.3)
sqlfluff PYPI version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - odd-cli =0.1.1, =0.2.4, =0.2.3, =2.0.32, =2.0.46 - sqlfluff-templater-dbt 3.0.3 - sqllineage 1.5.2 Source cves: CVE-2026-46373 Source advisory:...
dbt-coves (>=0.21.0a2, <=0.21.0a16), dwhgen (0.1.0) +1 more potentially affected by CVE-2026-46373 via sqlfluff (0.7.1)
sqlfluff PYPI version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - dbt-coves =0.21.0a2, =0.1.0, =0.14.0 Source cves: CVE-2026-46373 Source advisory: OSV:GHSA-WMHF-FQC8-VXHH...
alvin-cli (>=1.1.9, <=1.2.0), sqlfluff-templater-dbt (2.1.1) potentially affected by CVE-2026-46373 via sqlfluff (2.1.1)
sqlfluff PYPI version 2.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - alvin-cli =1.1.9, =1.2.0 - sqlfluff-templater-dbt 2.1.1 Source cves: CVE-2026-46373 Source advisory: OSV:GHSA-WMHF-FQC8-VXHH...
alvin-cli (0.0.1a0) potentially affected by CVE-2026-46373 via sqlfluff (0.12.0)
sqlfluff PYPI version 0.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on sqlfluff and may be impacted: - alvin-cli 0.0.1a0 Source cves: CVE-2026-46373 Source advisory: OSV:GHSA-WMHF-FQC8-VXHH...
Malicious code in buddyme (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f4ae4b8c00d27e82d54a5d2d960b1dc4f40ba15bc938355bad8421c338d6ef6 buddyme advertises a CLI agent. When installed and run, the default REPL routes every prompt the user types to third-party LLM providers Zhipu GLM at...
GHSA-CRC3-H8V6-QH57 GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection
Summary A security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. Details The vulnerability stems from the way GitHub CLI handles raw Actions log...
EUVD-2026-30549
GitHub CLI: GitHub Actions log output in gh run view allows terminal escape sequence injection...
GitHub CLI: GitHub Actions log output in `gh run view` allows terminal escape sequence injection
Summary A security vulnerability has been identified in GitHub CLI that could allow terminal escape sequence injection when users view GitHub Actions workflow logs using gh run view --log or gh run view --log-failed. Details The vulnerability stems from the way GitHub CLI handles raw Actions log...
CVE-2026-27173
The Apache Airflow CNCF Kubernetes provider is vulnerable to JWT token exposure in KubernetesExecutor command-line arguments. This flaw allows users with only read-only access to Kubernetes Pods to obtain tokens used by workers. An attacker could use these tokens to perform actions restricted to ...
MAL-2026-4453 Malicious code in @tarojs/cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59b4e6cd0fe6bd16c6fb2bd04e6542a2a3052182d8815a08b124df56f2d9fde2 On npm install, the package's postinstall script performs a reachability GET to https://taro.jd.com/ and, on success, invokes the package's own...
MAL-2026-4370 Malicious code in @bonsai-ai/claude-code (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad3b5646cf88b8eb5a7dbbec9fc2f1cfefcdf3a241d9604992e72c2f629889b9 Package published as @bonsai-ai/claude-code impersonates Anthropic's official @anthropic-ai/claude-code CLI. package.json sets author to 'Anthropic '...
