MCP Code Executor 命令注入漏洞

MCP Code Executor is a code execution server developed by bazinga012. Versions of MCP Code Executor prior to 0.3.0 have a command injection vulnerability, which stems from incorrect operations on the function installDependencies in the file src/index.ts, potentially leading to command injection...

Malicious code in peer-deps-external (npm)

The package 'peer-deps-external' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

abadpour (>=6.13.1 <=7.24.1), abcli (>=9.273.1 <=9.572.1) +702 more potentially affected by CVE-2025-14287 via mlflow (>=3.0.0rc2 <=3.6.0rc0)

mlflow PYPI version =3.0.0rc2, =6.13.1, =9.273.1, =2.0.0, =0.1.0, =0.1.0, =0.4.4, =0.3.0, =0.1.0, =1.0.0, =0.1.0, =1.0.0, =1.0.1 and more Source cves: CVE-2025-14287 Source advisory: SNYK:PYTHON-MLFLOW-15674468...

Fedora 43 : insight (2026-0106837085)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0106837085 advisory. New upstream snapshot. Fixes CVEs 2025-11494, 2025-11495, 2026-2341, 2026-3441, 2026-3442. Fixes CVEs 2025-69644, 2025-69645, 2025-69646. Fixes FTBF...

GlassWorm Supply-Chain Attack Abuses 72 Open VSX Extensions to Target Developers

Cybersecurity researchers have flagged a new iteration of the GlassWorm campaign that they say represents a "significant escalation" in how it propagates through the Open VSX registry. "Instead of requiring every malicious listing to embed the loader directly, the threat actor is now abusing...

com.azure.cosmos.spark:azure-cosmos-spark_4-0_2-13 (>=4.43.0 <=4.49.0), com.github.rumbledb:rumbledb (=2.0.0) +85 more potentially affected by CVE-2025-54920 via org.apache.spark:spark-core_2.13 (>=4.0.0-preview2 <=4.0.0)

org.apache.spark:spark-core2.13 MAVEN version =4.0.0-preview2, =4.43.0, =0.43.0-preview, =0.43.0-preview, =4.0.0-preview22.0.1, =0.0.3, =0.0.3, =7.0.1, =4.1.0, =0.0.1-poc, =0.0.1-poc, =0.0.1-poc, =0.0.1-poc, =0.0.1-poc8 and more Source cves: CVE-2025-54920 Source advisory:...

akurdyukov-tap-clickhouse (=0.0.1), asdjgasdghasdhjgasghd (=1.0.7) +81 more potentially affected by CVE-2026-32640 via simpleeval (>=0.9.1 <=1.0.4)

simpleeval PYPI version =0.9.1, =0.1.4, =0.1.0, =1.0.6, =0.0.5, =1.1.0, =0.1.3, =0.1.0, =0.3.0b1, =0.2.0, =0.1.0, =1.0.8 and more Source cves: CVE-2026-32640 Source advisory: OSV:GHSA-44VG-5WV2-H2HG...

@apollo/gateway (>=2.0.0 <=2.14.1), @dfanchon/gateway (=2.11.0) +68 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=2.10.0-alpha.0 <=2.9.5)

@apollo/query-planner NPM version =2.10.0-alpha.0, =2.0.0, =0.0.2-beta.4, =1.0.52, =1.7.3, =3.0.5, =3.0.4, =0.2.0, =0.11.46, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =8.6.7, =11.5.0 and more Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOQUERYPLANNER-15612460...

2mxdev-gql-gateway (=1.0.0), @2mxdev/gql-gateway (>=1.0.0 <=4.0.2) +207 more potentially affected by CVE-2026-32621 via @apollo/query-planner (>=0.0.11 <=2.9.5)

@apollo/query-planner NPM version =0.0.11, =1.0.0, =0.24.2, =1.0.0, =0.0.1-feature-ci-publish.2, =0.0.1-feature-ci-publish.2, =0.6.5, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =0.0.22 and more Source cves: CVE-2026-32621 Source advisory: OSV:GHSA-PFJJ-6F4P-RVMH...

@faasjs/graphql-server (>=0.0.2-beta.4 <=0.0.2-beta.253), @galdirik/common (>=1.0.52 <=1.1.42) +65 more potentially affected by CVE-2026-32621 via @apollo/gateway (>=2.0.0-preview.2 <=2.9.3)

@apollo/gateway NPM version =2.0.0-preview.2, =0.0.2-beta.4, =1.0.52, =1.7.3, =3.0.5, =3.0.4, =0.2.0, =0.11.46, =1.0.0, =1.0.0, =1.0.0, =0.0.1, =8.6.7, =6.0.0-dev.156-swarm.1, =0.7.0-alpha.3, =0.7.32 and more Source cves: CVE-2026-32621 Source advisory: SNYK:JS-APOLLOGATEWAY-15612461...

0utmailauth (=1.0.0), 0xsodium (>=0.2.0 <=0.14.0) +13862 more potentially affected by CVE-2026-1526 via undici (>=0.3.3 <=6.23.0)

undici NPM version =0.3.3, =0.2.0, =1.0.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.0.21, =2.1.0, =2.1.0, =2.1.1 and more Source cves: CVE-2026-1526 Source advisory: OSV:GHSA-VRM6-8VPV-QV8Q...

0utmailauth (=1.0.0), 0xsodium (>=0.2.0 <=0.14.0) +13862 more potentially affected by CVE-2026-2229 via undici (>=0.3.3 <=6.23.0)

undici NPM version =0.3.3, =0.2.0, =1.0.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.0.21, =2.1.0, =2.1.0, =2.1.1 and more Source cves: CVE-2026-2229 Source advisory: OSV:GHSA-V9P9-HFJ2-HCW8...

@01.software/cli (>=0.1.1 <=0.2.0-dev.260310.cf511cb), @01.software/sdk (>=0.0.1-251008.90016 <=0.3.0) +398 more potentially affected by CVE-2026-1527 via undici (>=7.0.0 <=7.22.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.1, =0.0.2, =0.1.0, =0.0.33, =0.0.1, =1.0.0, =21.0.0, =0.5.0, =1.0.1, =2.8.7 and more Source cves: CVE-2026-1527 Source advisory: OSV:GHSA-4992-7RV2-5PVQ...

@01.software/cli (>=0.1.1 <=0.2.0-dev.260310.cf511cb), @01.software/sdk (>=0.1.0-dev.260119.0a66443 <=0.3.0) +226 more potentially affected by CVE-2026-2581 via undici (>=7.18.0 <=7.22.0)

undici NPM version =7.18.0, =0.1.1, =0.1.0-dev.260119.0a66443, =0.0.1, =0.1.0, =0.1.3, =21.1.0, =1.0.1, =1.0.1-beta.0, =2026.1.14, =0.13.100, =1.21.1, =0.12.5, =0.0.1, =0.0.0-dev.20251108074143, =1.2.1-dev.20260414125348 and more Source cves: CVE-2026-2581 Source advisory: OSV:GHSA-PHC3-FGPG-7M6H...

@01.software/cli (>=0.1.1 <=0.2.0-dev.260310.cf511cb), @01.software/sdk (>=0.0.1-251008.90016 <=0.3.0) +398 more potentially affected by CVE-2026-1528 via undici (>=7.0.0 <=7.22.0)

undici NPM version =7.0.0, =0.1.1, =0.0.1-251008.90016, =0.0.6, =0.0.1, =0.0.2, =0.1.0, =0.0.33, =0.0.1, =1.0.0, =21.0.0, =0.5.0, =1.0.1, =2.8.7 and more Source cves: CVE-2026-1528 Source advisory: OSV:GHSA-F269-VFMQ-VJVJ...

0utmailauth (=1.0.0), 0xsodium (>=0.2.0 <=0.14.0) +13862 more potentially affected by CVE-2026-1525 via undici (>=0.3.3 <=6.23.0)

undici NPM version =0.3.3, =0.2.0, =1.0.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =1.0.21, =2.1.0, =2.1.0, =2.1.1 and more Source cves: CVE-2026-1525 Source advisory: OSV:GHSA-2MJP-6Q6P-2QXM...

gistit-daemon (>=0.2.0 <=0.2.1), libp2p (>=0.42.0 <=0.42.2) +3 more potentially affected by CVE-2026-32314 via yamux (=0.10.2)

yamux CARGO version =0.10.2 is affected by a known vulnerability. The following packages have a transitive dependency on yamux and may be impacted: - gistit-daemon =0.2.0, =0.42.0, =0.42.2 - libp2p-bitswap =0.21.0 - libp2p-swarm-test =0.1.0 - libp2p-yamux =0.35.0 Source cves: CVE-2026-32314 Sourc...

article-extract (>=0.1.2 <=0.1.3), athlinks-races (>=0.0.4 <=0.0.7) +51 more potentially affected by unknown CVE via scrapy (>=1.4.0 <=2.14.1)

scrapy PYPI version =1.4.0, =0.1.2, =0.0.4, =3.4.0, =2.8.3, =0.0.1.dev1, =1.3.0, =1.2.1.20160901, =0.2.0, =0.0.5, =0.2.4, =0.0.2, =0.3.0a0, =0.0.20, =0.0.34 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-SCRAPY-15624315...

aksharify (=0.2.0), buildbot-badges (>=1.7.0 <=1.8.2) +51 more potentially affected by CVE-2026-31899 via cairosvg (>=0.5.0 <=2.8.2)

cairosvg PYPI version =0.5.0, =1.7.0, =0.1.0, =0.20.7, =1.0.0b1, =0.0.2, =2025.5.0, =1.0.0, =0.1.0, =1.3.6, =0.2.2, =0.2.32 and more Source cves: CVE-2026-31899 Source advisory: OSV:GHSA-F38F-5XPM-9R7C...

-tompan-reacttemplate (>=1.0.1 <=1.1.0), 02_add_lodash (=1.0.0) +18519 more potentially affected by CVE-2026-32141 via flatted (>=0.2.3 <=3.3.4)

flatted NPM version =0.2.3, =1.0.1, =1.0.0, =0.1.0, =1.0.1, =0.1.0, =0.1.2, =0.0.2, =0.0.36 - 6o-vsamaru =1.0.0 and more Source cves: CVE-2026-32141 Source advisory: OSV:GHSA-25H7-PFQ9-P65F...