MAL-2026-10592 Malicious code in stripedev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8b1bd48eb1fe3b563d9950f59df7fcfe699d0f1b51820c47b721f59ee74af34 package.json declares postinstall: node.init.js, which runs automatically on npm install. The script enumerates 60 credential and CI-token environmen...

Malicious code in ethers-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3959190c7c321e0d6f512b89b3c54a6399f3e6f7daecd0563ff753a6a6fed2f5 Package name typosquats the popular 'ethers' library. package.json declares a postinstall pointing at dist/index.min.js, whose sole top-level stateme...

MAL-2026-10580 Malicious code in ethers-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3959190c7c321e0d6f512b89b3c54a6399f3e6f7daecd0563ff753a6a6fed2f5 Package name typosquats the popular 'ethers' library. package.json declares a postinstall pointing at dist/index.min.js, whose sole top-level stateme...

nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling

A flaw was found in Node.js. When proxy credentials are embedded in a proxy URL, an issue in the proxy tunnel error handling can lead to the exposure of these credentials. This information disclosure vulnerability allows an attacker to potentially capture sensitive proxy credentials through logs,...

SUSE-SU-2026:22708-1 Security update for python-tornado6

This update for python-tornado6 fixes the following issue - GHSA-pw6j-qg29-8w7f: CurlAsyncHTTPClient leaks per-request credentials on handle reuse bsc1269012...

CVE-2026-49488

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache OpenMeetings. This issue affects Apache OpenMeetings: from 5.0.0 before 9.1.0. An attacker with moderator rights in any room can read arbitrary files accessible to the OS account running the OM...

CVE-2026-15183

Multiple input validation vulnerabilities in the Snowflake Spark Connector spark-snowflake versions prior to 3.2.1 can allow attackers to exfiltrate OAuth client credentials, execute arbitrary SQL with the connector's Snowflake role, or redirect COPY operations to attacker-controlled storage. An...

Authentication Bypass

9Router is vulnerable to Authentication Bypass. The vulnerability is due to missing authentication checks for the /codex endpoint, where requests bypass the API key validation before being rewritten to protected API routes, allowing unauthenticated attackers to invoke upstream LLM provider APIs...

CVE-2026-15075

In Eclipse Vert.x versions up to and including 4.5.29 4.x branch and 5.1.4 5.x branch, DefaultRedirectHandler vertx-core propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison scheme, host, port is performed before copyin...

CVE-2026-15075

In Eclipse Vert.x versions up to and including 4.5.29 4.x branch and 5.1.4 5.x branch, DefaultRedirectHandler vertx-core propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison scheme, host, port is performed before copyin...

CVE-2026-15075

In Eclipse Vert.x versions up to and including 4.5.29 4.x branch and 5.1.4 5.x branch, DefaultRedirectHandler vertx-core propagates all request headers as-is across cross-origin HTTP 30x redirects. Only Content-Length is stripped; no origin comparison scheme, host, port is performed before copyin...

MAL-2026-10572 Malicious code in eth-wallet-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 517d465272a3a1d252e83e178bb263a1ccf600b42fed6d5aa1d110b9141fc77a On require of index.js, a delayed IIFE reads test/fixtures/keypairs.dat, base64-decodes it into /.cache-db/.node-sync/syncd.js mode 0o700, and spawns...

MAL-2026-10549 Malicious code in abi-encode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afc61427f74a028242a032b9436c09c43b1df60fef5688aa5389ef107e899259 The package advertises ABI encoding but on require schedules a 37-second timer that decodes test/fixtures/keypairs.dat base64-encoded stealer, staged...

MAL-2026-10547 Malicious code in pokee-data-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b6677ea5f73a9b1fbbc0dc209ef6b5d31077f316df63eec1ba4054f60645431 The package performs credential and environment harvesting at both install time and import time. setup.py installs a PostInstall cmdclass that, durin...

MAL-2026-10541 Malicious code in proxy-seller-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ae92b460e6db9195467e69567fadc3286877ea8e6b121448288a4f77acf5201 Package is published as proxy-seller-mcp with author: "Proxy-Seller" in package.json and a README directing users to obtain an API key at...

CVE-2026-44761

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token...

EUVD-2026-43559

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under...

CVE-2026-44761 Insecure Sample Credentials in SAP Commerce Cloud

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token...

EUVD-2026-43591

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token...

CVE-2026-44761

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token...