CVE-2026-10177 Aider-AI Aider AWS EC2 Metadata Endpoint api_docs.py requests.get server-side request forgery

A security vulnerability has been detected in Aider-AI Aider 0.86.3. This affects the function requests.get of the file apidocs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has...

Malicious code in cscc-glass-house (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 20f53888d08d0aa70146b50e8dc761373490363f9081ea0adb9fb93cfd2b6240 Package implements exfiltrating credentials from cloud environments to a hardcoded location. Some code parts suggest it may be part of a CTF. --- Category:...

MAL-2026-5096 Malicious code in cscc-glass-house (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 20f53888d08d0aa70146b50e8dc761373490363f9081ea0adb9fb93cfd2b6240 Package implements exfiltrating credentials from cloud environments to a hardcoded location. Some code parts suggest it may be part of a CTF. --- Category:...

CVE-2026-42502 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

CVE-2026-42502 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6. A patched version of the package is available...

CVE-2026-39821 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

CVE-2026-39821 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6. A patched version of the package is available...

CVE-2026-25680 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

CVE-2026-25680 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6. A patched version of the package is available...

CVE-2026-25681 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

CVE-2026-25681 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6. A patched version of the package is available...

CVE-2026-42506 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6

CVE-2026-42506 affecting package kube-vip-cloud-provider for versions less than 0.0.10-6. A patched version of the package is available...

CVE-2026-39829 affecting package cf-cli for versions less than 8.7.11-6

CVE-2026-39829 affecting package cf-cli for versions less than 8.7.11-6. A patched version of the package is available...

CVE-2026-27136 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4

CVE-2026-27136 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4. A patched version of the package is available...

CVE-2026-39830 affecting package cf-cli for versions less than 8.7.11-6

CVE-2026-39830 affecting package cf-cli for versions less than 8.7.11-6. A patched version of the package is available...

CVE-2026-42506 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4

CVE-2026-42506 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4. A patched version of the package is available...

CVE-2026-39821 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4

CVE-2026-39821 affecting package cloud-provider-kubevirt for versions less than 0.5.1-4. A patched version of the package is available...

PT-2026-45205

Name of the Vulnerable Software and Affected Versions Cloud Hypervisor versions 21.0 through 51.1 Description A guest can cause a use-after-free in the cloud-hypervisor process by submitting two virtio-block descriptor chains that reuse the same head index while asynchronous block I/O such as io...

OPENSUSE-SU-2026:10907-1 cloud-hypervisor-52.0-1.1 on GA media

These are all security issues fixed in the cloud-hypervisor-52.0-1.1 package on the GA media of openSUSE Tumbleweed...

Malicious Package

Overview @cloudplatform-single-spa/cloud-dns is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious Package

Overview @cloudplatform-single-spa/dataplatform-metastore is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious Package

Overview @cloudplatform-single-spa/dataplatform is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

Malicious Package

Overview gcp-api-enabler is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-9831

A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could, under specific high-concurrency traffic conditions, intermittently allow requests authenticated with an Extreme Platform ONE /IAM-issued API key to receive response data for another tenant. The issu...