Lucene search
+L

448 matches found

OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/04 1:18 p.m.6 views

Malicious code in @servicetitan/datadog-rum (npm)

npm/@servicetitan/datadog-rum is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

5.5AI score
SaveExploits0References12
OSV
OSV
added 2026/08/04 1:17 p.m.8 views

MAL-2026-11937 Malicious code in @servicetitan/titan-chat-ui-common (npm)

npm/@servicetitan/titan-chat-ui-common is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized...

5.7AI score
SaveExploits0References12
OSV
OSV
added 2026/08/04 1:17 p.m.8 views

MAL-2026-11910 Malicious code in @servicetitan/onboarding-ui (npm)

npm/@servicetitan/onboarding-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

5.7AI score
SaveExploits0References12
OSV
OSV
added 2026/08/04 12:28 p.m.11 views

MAL-2026-11928 Malicious code in @servicetitan/suppress-warnings (npm)

npm/@servicetitan/suppress-warnings is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

5.8AI score
SaveExploits0References18
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/04 11:52 a.m.34 views

Malicious code in file-entry-cache (npm)

npm/file-entry-cache version 11.1.6 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

5.7AI score
SaveExploits0References6
OSV
OSV
added 2026/08/04 11:37 a.m.14 views

MAL-2026-11559 Malicious code in @cacheable/net (npm)

npm/@cacheable/net version 2.1.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

5.9AI score
SaveExploits0References6
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/04 11:36 a.m.52 views

Malicious code in @cacheable/utils (npm)

npm/@cacheable/utils version 2.5.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

6.2AI score
SaveExploits0References6
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/04 11:35 a.m.27 views

Malicious code in @cacheable/memory (npm)

npm/@cacheable/memory version 2.2.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

6.4AI score
SaveExploits0References6
OSV
OSV
added 2026/08/04 11:34 a.m.8 views

MAL-2026-11560 Malicious code in @cacheable/node-cache (npm)

npm/@cacheable/node-cache version 3.1.2 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases...

5.8AI score
SaveExploits0References6
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/04 11:34 a.m.8 views

Malicious code in @cacheable/node-cache (npm)

npm/@cacheable/node-cache version 3.1.2 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases...

5.8AI score
SaveExploits0References6
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/04 11:28 a.m.19 views

Malicious code in cacheable (npm)

npm/cacheable version 2.5.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub...

6.3AI score
SaveExploits0References6
OSV
OSV
added 2026/08/04 11:28 a.m.14 views

MAL-2026-11963 Malicious code in cacheable (npm)

npm/cacheable version 2.5.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through GitHub...

6.3AI score
SaveExploits0References6
CVE
CVE
added 2026/08/04 6:0 a.m.50 views

CVE-2026-14939

The Visualizer WordPress plugin is affected: versions before 4.0.6 expose a vulnerability where an attacker with Contributor-level access can supply a URL that is not validated to safe address ranges, enabling server-side requests (SSRF) to link-local instance-metadata endpoints. The fetched resp...

6.8CVSS5.5AI score0.00235EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/04 6:0 a.m.14 views

EUVD-2026-52588

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched...

6.8CVSS5.5AI score0.00235EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/23 4:37 p.m.42 views

CVE-2026-65698

The CVE-2026-65698 entry describes a path traversal vulnerability in Void 1.3.4’s AI agent file-reading tools. The read_file, ls_dir, get_dir_tree, and search_* tools allow network-adjacent attackers to inject instructions and read arbitrary host files outside the open workspace, bypassing worksp...

6CVSS5.6AI score0.00347EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/23 4:37 p.m.42 views

CVE-2026-65698 Void 1.3.4 Path Traversal via AI Agent File-Reading Tools

Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file://...

6CVSS0.00347EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/07/23 4:37 p.m.18 views

EUVD-2026-48312

Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the open workspace by injecting instructions into content the agent processes. Attackers can supply absolute paths or file://...

6CVSS5.5AI score0.00347EPSS
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/22 8:24 p.m.22 views

Malicious code in n8n-nodes-task-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 991093c97f0d954740c4b72a2e7725a501df211c94634979ebadc52652f2ebe8 The package impersonates the n8n task-runner subsystem but its shipped n8n node MyNode.js is a no-op stub whose execute returns . The real payload...

5.4AI score
SaveExploits0References17
EUVD
EUVD
added 2026/07/21 9:32 p.m.9 views

EUVD-2026-46427

Keep commit 91c75e0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a...

9.3CVSS5.6AI score0.00246EPSS
SaveExploits0References4
NVD
NVD
added 2026/07/21 9:16 p.m.8 views

CVE-2026-65057

Keep commit 91c75e0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the backend issue arbitrary HTTP requests by supplying attacker-controlled host values to the unprotected healthcheck endpoint. Attackers can send a crafted JSON payload with a...

9.3CVSS0.00246EPSS
SaveExploits0References3
Rows per page
Query Builder