CVE-2024-24590

CVE-2024-24590 Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with. Usage 1. paste the credentials given and run...

Malware in @sxm-web/client-sdk-core

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @sxm-web/client-sdk-core (npm)

@sxm-web/client-sdk-core is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 2.0.0, 1.1.0, 3.0.0, 13.3.7 has a postinstall script th...

Malicious Package

Overview @sxm-web/client-sdk-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2026-18319 Malicious code in @sxm-web/client-sdk-core (npm)

@sxm-web/client-sdk-core is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 2.0.0, 1.1.0, 3.0.0, 13.3.7 has a postinstall script th...

Malicious code in @sxm-web/client-sdk-core (npm)

@sxm-web/client-sdk-core is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 0.0.1, 1.0.0, 1.0.1, 2.0.0, 1.1.0, 3.0.0, 13.3.7 has a postinstall script th...

GHSA-6PRH-2H8M-C8CW MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies

Summary In affected versions, the SDK's HTTP client transports and OAuth requests followed redirects to any origin. If an MCP server or authorization server redirected a request to another origin, that origin received custom request headers such as an X-API-Key set in requestInit.headers and the...

Azure Key Vault Client SDK Elevation of Privilege Vulnerability

Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network...

Decepticon v1.2.2

Decepticon — Autonomous Red Team Agent "Another AI hacker? Let us guess — it runs nmap and writes a report." Commercial product demo ☁️ Don't want to self-host? Decepticon is live in the cloud. Skip the Docker setup — run autonomous red-team engagements right from your browser. Open-source CLI dem...

Malicious code in alicloud-client-sdk (PyPI)

Source: kam193 59563b61e548ff83488a4940e0511825ebf1a2d0995c83e0056e07fd7a4bd782 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote server, 2 packages named like alicloud-client are clones of...

CVE-2025-40945: Untrusted Search Path

A vulnerability has been identified in COMOS V10.4.5 All versions V10.4.5.0.2, COMOS V10.6 All versions V10.6.1, Designcenter NX All versions V2512.7000, Simcenter 3D All versions V2512.7000, Simcenter Femap V2506 All versions V2506.0003, Simcenter Femap V2512 All versions V2512.0002, Simcenter...

@knocklabs/client (>=0.21.6, <=0.22.1), @knocklabs/expo (>=0.5.0, <=0.6.9) +8 more potentially affected by CVE-2026-56812 via phoenix (>=1.8.0, <=1.8.7)

phoenix NPM version =1.8.0, =0.21.6, =0.5.0, =0.11.0, =0.13.0, =0.8.0, =0.0.2, =0.0.1, =0.0.2, =0.0.1, =2.1.8, =2.5.4 Source cves: CVE-2026-56812 Source advisory: SNYK:JS-PHOENIX-17889828...

Allegro AI ClearML path traversal vulnerability

A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’s system when interacted with...

@diligencefabric/client-sdk (>=0.0.1, <=0.0.2), @jtl-software/cloud-apps-rest-sdk (0.0.1) potentially affected by CVE-2026-49336 via @microsoft/kiota-http-fetchlibrary (1.0.0-preview.100)

@microsoft/kiota-http-fetchlibrary NPM version 1.0.0-preview.100 is affected by a known vulnerability. The following packages have a transitive dependency on @microsoft/kiota-http-fetchlibrary and may be impacted: - @diligencefabric/client-sdk =0.0.1, =0.0.2 - @jtl-software/cloud-apps-rest-sdk...

@diligencefabric/client-sdk (>=0.0.1, <=0.0.2), @jtl-software/cloud-apps-rest-sdk (0.0.1) potentially affected by CVE-2026-49336 via @microsoft/kiota-http-fetchlibrary (1.0.0-preview.100)

@microsoft/kiota-http-fetchlibrary NPM version 1.0.0-preview.100 is affected by a known vulnerability. The following packages have a transitive dependency on @microsoft/kiota-http-fetchlibrary and may be impacted: - @diligencefabric/client-sdk =0.0.1, =0.0.2 - @jtl-software/cloud-apps-rest-sdk...

@diligencefabric/client-sdk (>=0.0.1, <=0.0.2), @jtl-software/cloud-apps-rest-sdk (0.0.1) potentially affected by CVE-2026-49336 via @microsoft/kiota-http-fetchlibrary (1.0.0-preview.100)

@microsoft/kiota-http-fetchlibrary NPM version 1.0.0-preview.100 is affected by a known vulnerability. The following packages have a transitive dependency on @microsoft/kiota-http-fetchlibrary and may be impacted: - @diligencefabric/client-sdk =0.0.1, =0.0.2 - @jtl-software/cloud-apps-rest-sdk...

@diligencefabric/client-sdk (>=0.0.1, <=0.0.2), @jtl-software/cloud-apps-rest-sdk (0.0.1) potentially affected by CVE-2026-49336 via @microsoft/kiota-http-fetchlibrary (1.0.0-preview.100)

@microsoft/kiota-http-fetchlibrary NPM version 1.0.0-preview.100 is affected by a known vulnerability. The following packages have a transitive dependency on @microsoft/kiota-http-fetchlibrary and may be impacted: - @diligencefabric/client-sdk =0.0.1, =0.0.2 - @jtl-software/cloud-apps-rest-sdk...

EUVD-2026-36535

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.77 and 9.9.1-alpha.1, an unauthenticated attacker who knows a publicly-known Parse Application ID can submit a single HTTP request whose client SDK version field contains...

PT-2026-40789

Two CVEs CVE-2026-30889 and CVE-2026-31200 were classic JSON-RPC parser bugs in popular MCP client SDKs. One allowed a server response to set arbitrary properties on the client's session-state object via prototype pollution. The other allowed a server to inject batched…...

CVE-2026-41886 locize Client SDK: Cross-origin DOM XSS & Handler Hijack Through Missing e.origin Validation in InContext Editor

locize is a localization platform that connects code and i18n setup. Prior to version 4.0.21, the locize client SDK registers a window.addEventListener"message", … handler that dispatches to registered internal handlers editKey, commitKey, commitKeys, isLocizeEnabled, requestInitialize, … without...