MAL-2026-10148 Malicious code in polygon-gamma-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a49bd3ddb3340e0ef3c76465b6e275d45ddc8eecdbd742747acde8588a2018b4 [email protected] advertises itself as a 'TypeScript SDK for the Polymarket CLOB API' but ships no Polymarket API surface. The exported...

CVE-2026-55500 9router: Exposure of Sensitive Information and Unprotected Database Import/Export Allows Complete Credential Theft and Database Takeover

9Router is an AI router & token saver. Prior to 0.4.80, the /api/settings/database endpoint allows full database export containing all credentials, API keys, OAuth tokens, and settings and full database import complete overwrite without any authentication requirement beyond the ALWAYSPROTECTED...

CVE-2026-55500

CVE-2026-55500 (9router) exposes a critical flaw in the /api/settings/database endpoint. The GET export returns the entire database, including plaintext API keys, OAuth tokens, and provider credentials, while POST can wipe-and-replace the database with attacker-controlled data. This bypasses auth...

SUSE CVE-2026-47828

During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network...

Malicious code in polymarket-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd77c8861490c0b5607b4029f8f9e51f12efb83a6696fc51b953b0a3cde1356b The package impersonates the Polymarket brand name polymarket-apis, author polymarket but contains no Polymarket API integration. Its exported...

MAL-2026-10067 Malicious code in polymarket-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd77c8861490c0b5607b4029f8f9e51f12efb83a6696fc51b953b0a3cde1356b The package impersonates the Polymarket brand name polymarket-apis, author polymarket but contains no Polymarket API integration. Its exported...

CVE-2026-31982

An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who...

CVE-2026-31982 Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0

An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who...

CVE-2026-31982

The connected records identify CVE-2026-31982 as an Open Redirect vulnerability in SAML Single Sign-On affecting Guardian/CMC prior to version 26.2.0. The root cause is insufficient validation of a user-controlled redirection parameter in the SAML sign-in endpoint, enabling an unauthenticated att...

CVE-2026-31982 Open Redirect in SAML Single Sign-On in Guardian/CMC before 26.2.0

An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who...

EUVD-2026-42532

An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who...

CVE-2026-31982

An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who...

EUVD-2026-42514

During bosh create-env and bosh delete-env, the CLI uploads compiled CPI packages and rendered job templates to the new VM's DAV blobstore over HTTPS without verifying the server certificate, even though a CA certificate for that endpoint is available in the installation manifest. A network...

Malicious code in @wagni_bot/polygon-sdk (npm)

The npm package @wagnibot/polygon-sdk is a supply-chain credential stealer disguised as a Polygon SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle hook...

MAL-2026-11111 Malicious code in @wagni_bot/hyperliquid (npm)

The npm package @wagnibot/hyperliquid is a supply-chain credential stealer disguised as a Hyperliquid SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle ho...

Malicious code in @wagni_bot/metemask-sdk (npm)

The npm package @wagnibot/metemask-sdk is a supply-chain credential stealer disguised as a MetaMask misspelled 'metemask' SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...

MAL-2026-11116 Malicious code in @wagni_bot/wagni (npm)

The npm package @wagnibot/wagni is a supply-chain credential stealer disguised as a the campaign's own namesake handle SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a...

MAL-2026-10033 Malicious code in @wagni_bot/polymarket-sdk (npm)

The npm package @wagnibot/polymarket-sdk is a supply-chain credential stealer disguised as a Polymarket SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle...

Malicious code in @wagni_bot/bsc-sdk (npm)

The npm package @wagnibot/bsc-sdk is a supply-chain credential stealer disguised as a BNB Smart Chain BSC SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycl...

Malicious code in @wagni_bot/orca-sdk (npm)

The npm package @wagnibot/orca-sdk is a supply-chain credential stealer disguised as a Orca Solana DEX SDK. It is one member of a coordinated campaign of 25 crypto/web3 typosquat packages published under the single npm scope @wagnibot on 2026-07-09. Each package declares a postinstall lifecycle...