CVE-2026-55403

CVE-2026-55403 affects the Python package datamodel-code-generator. In versions prior to 0.63.0, the code path in src/datamodel_code_generator/http.py:get_body reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects to fetch remote schemas. This can lea...

CVE-2026-13463

IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files...

CVE-2026-13463

IBM Cloud Pak System 2.3.5.0 is affected by CVE-2026-13463 due to hard-coded credentials in IBM Storage Protect leading to local disclosure of sensitive information via log files. The IBM Security Bulletin (CVE-2026-13463) notes the root cause CWE-798 and specifies a fix: upgrade to version 2.3.5...

EUVD-2026-50065

IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files...

CVE-2026-13463 Due to use of IBM Storage Protect, IBM Cloud Pak System is affected by vulnerability []

IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files...

CVE-2026-18107

A flaw was found in CRIU's handling of restartable sequences rseq during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the process credentials saved in the...

CVE-2026-18107

CRIU vulnerability CVE-2026-18107 involves how CRIU handles restartable sequences (rseq) during checkpoint/restore. A container-embedded process can register an rseq critical section that hijacks CRIU’s parasite code injection, enabling spoofed credentials saved in the checkpoint image. On restor...

CVE-2026-18107

A flaw was found in CRIU's handling of restartable sequences rseq during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the process credentials saved in the...

CVE-2026-16498 terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode

The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fix...

EUVD-2026-49940

The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability,...

CVE-2026-16496

The CVE concerns terraform-mcp-server prior to version 1.1.0, where an authorization bypass in the streamable-HTTP stateful transport mode could allow a user who obtains another user’s MCP session ID to execute tool calls using that user’s Terraform credentials. Affected component: terraform-mcp-...

EUVD-2026-49904

TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse without normalization, dot-segment...

CVE-2026-7775

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 is vulnerable to stored cross-site scripting. This vulnerability allows a...

CVE-2026-7775

CVE-2026-7775 affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (versions 6.2.0.0–6.2.0.6, 6.2.1.0–6.2.1.1_2, 6.2.2.0–6.2.2.0_1). The issue is a stored cross-site scripting vulnerability in the Web UI that a privileged user can exploit to embed arbitrary JavaScript, potentially al...

MAL-2026-11147 Malicious code in simple-probe-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0457a026ab28fbb641d11e4e9ac9d60d026fd77210972f72e6ac931b4b06c59c On npm install, postinstall.js executes shell commands that query cloud instance metadata services AWS IMDS at 169.254.169.254, plus Tencent, Aliyun,...

Malicious code in simple-probe-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0457a026ab28fbb641d11e4e9ac9d60d026fd77210972f72e6ac931b4b06c59c On npm install, postinstall.js executes shell commands that query cloud instance metadata services AWS IMDS at 169.254.169.254, plus Tencent, Aliyun,...

Malicious code in vtranalytic (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897fa80f1d8a55ff480d6c7e7a71200ac31530a9f5d928389545b597c7b45903 The package implements a full remote-administration toolkit controlled through a Telegram bot. It polls the Telegram Bot API at...

MAL-2026-11156 Malicious code in vtranalytic (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 897fa80f1d8a55ff480d6c7e7a71200ac31530a9f5d928389545b597c7b45903 The package implements a full remote-administration toolkit controlled through a Telegram bot. It polls the Telegram Bot API at...

MAL-2026-11123 Malicious code in @yancyyu/agentcli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1 The @yancyyu/agentcli package installs a telemetry worker dist/telemetry-worker.bundle.mjs that is started by agentcli init / agentcli usage start an...

Malicious code in @yancyyu/agentcli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1 The @yancyyu/agentcli package installs a telemetry worker dist/telemetry-worker.bundle.mjs that is started by agentcli init / agentcli usage start an...