MAL-2026-6551 Malicious code in anthropic-internal-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab3bb04aee6f5f1d8768b7fd2173cd7c0cac18b5d83d6a83cf2be96a7512d8f7 Package name impersonates the Anthropic namespace and ships a preinstall hook scripts.preinstall = 'node index.js' that executes on every npm install...

Malicious code in ryan-pdf-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3d966501b5f533318c26b54887cd29b3cd6c9495035a0f74519ba349357e3eb [email protected] is an empty stub package index.js exports whose sole purpose is to deliver an off-registry payload at install time. Its package.js...

CVE-2026-54353

Budibase is an open-source low-code platform. Prior to 3.39.9, authenticated users with automation permissions can bypass Budibase's SSRF blacklist through DNS rebinding. The outbound fetch flow validates a hostname against the blacklist before the request is sent, but the actual socket connectio...

CVE-2026-50137

Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id app... and an S3-source datasource id ds... can call this endpoint with no auth and obtain a 15-minute pre-signed PUT URL minted on the victim's IAM identity. The endpoin...

Security Bulletin: Multiple vulnerabilities in IBM Watsonx BI Assistant for CP4D

Summary Multiple vulnerabilities were addressed in IBM Watsonx BI Assistant for CP4D version 5.4.0 Vulnerability Details CVEID:CVE-2026-26996 DESCRIPTION: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerab...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: frankenphp-8.2, gatekeeper, grafana-fips, minio-fips, containerd, chisel, trivy-fips, argocd-image-updater-fips, tekton-pipelines-fips, loki, rancher-agent, external-secrets-operator-fips, traefik-fips, tekton-pipelines, calico-fips, fscrypt, omnictl-multiarch-fips,...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53recoverycontrolconfig-fips, helmfile, google-guest-agent, juicefs, crossplane-provider-aws-organizations-fips, sops-fips, crossplane-provider-aws-chime-fips, crossplane-provider-aws-cloudformation, crossplane-provider-azure-servicefabri...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: pulumi-language-java, external-dns, datadog-agent, gitlab-kas, caddy, kots, trivy, kubescape, scorecard, ko, docker-cli-buildx, gptscript, rootlesskit, cert-manager, gomplate, spire-server, glab, slsa-verifier, kaf, loki, cilium, prometheus, step-kms-plugin, argo-cd,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: k3s, external-dns, zarf, nerdctl, gitea, flux-source-controller, gitlab-kas, osv-scanner, kots, trivy, trivy-operator, kubescape, spire-server, mattermost, kine, cert-manager, containerd, kaf, external-secrets-operator, fscrypt, loki, cilium, opentelemetry-collector,...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: pulumi-language-java, external-dns, datadog-agent, gitlab-kas, caddy, kots, trivy, kubescape, scorecard, ko, docker-cli-buildx, gptscript, rootlesskit, cert-manager, gomplate, spire-server, glab, slsa-verifier, kaf, loki, cilium, prometheus, step-kms-plugin, argo-cd,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: pulumi-language-java, external-dns, gitlab-kas, caddy, kots, trivy, kubescape, scorecard, spire-server, docker-cli-buildx, gptscript, cert-manager, gomplate, kaf, loki, cilium, prometheus, step-kms-plugin, argo-cd, pulumi-kubernetes-operator, helm, witness, openbao,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: k3s, external-dns, nerdctl, gitlab-kas, kots, spire-server, docker-cli-buildx, mattermost, kine, cert-manager, containerd, kaf, buildah, external-secrets-operator, fscrypt, loki, cilium, opentelemetry-collector, snyk-cli, prometheus, kubernetes, istio, telegraf,...

EUVD-2026-37512

pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses incomplete fix of CVE-2026-46678...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the image import process. An attacker can interact with internal network infrastructure and perform error-based port scanning by supplying a crafted URL to the /images endpoint, which causes the daemo...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the image import process. An attacker can interact with internal network infrastructure and perform error-based port scanning by supplying a crafted URL to the /images endpoint, which causes the daemo...

EUVD-2026-39819

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, destructor of JSON Object results in stack overflow when deeply O100K nested objects are present. This vulnerability is fixed in 1.35.11, 1.36.7, 1.37.3, and 1.38.1...

CVE-2026-28385 SSRF via image import from URL allows internal network probing by authenticated users

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery SSRF vulnerability in the image import functionality allows authenticated users with the cancreateimages entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a...

EUVD-2026-39805

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery SSRF vulnerability in the image import functionality allows authenticated users with the cancreateimages entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a...

CVE-2026-28385

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery SSRF vulnerability in the image import functionality allows authenticated users with the cancreateimages entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a...

CVE-2026-28385 SSRF via image import from URL allows internal network probing by authenticated users

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery SSRF vulnerability in the image import functionality allows authenticated users with the cancreateimages entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a...