MAL-2026-10740 Malicious code in myreviews-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c41d5d4352e265f0efbc0089a19c5773ceeb76c0265831eeeeca19151fe4f64 package.json declares a postinstall lifecycle hook that runs node -e to issue an HTTPS GET to a hardcoded webhook.site collector URL, appending the...

MAL-2026-10742 Malicious code in node-as-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 616f74a5722026c25913e644651f1edc57ccb3ca2a6145c1543ff802b3b883b9 On npm install, package.json's postinstall hook runs node test.js, which loads index.js and immediately invokes two harvest routines. The first...

CVE-2026-46336

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded files with path traversal sequences because app/models/modelfile.rb uses the user-controlled...

CVE-2026-44968 dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, rundbtcommand in src/dbtmcp/dbtcli/tools.py appended unsanitized nodeselection and resourcetype values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-di...

CVE-2026-47729

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway src/clients/FtpGateway.cc, Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed...

CVE-2026-46336

CVE-2026-46336 affects Manyfold (0.96.0–0.140.0). Authenticated users can rename uploaded files, and due to unsanitized user-controlled filenames in app/models/model_file.rb used with File.join(model.path, filename), path traversal may move/write files outside the library directory. Impact: poten...

CVE-2026-46336

Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. From 0.96.0 until 0.140.0, authenticated users can rename uploaded files with path traversal sequences because app/models/modelfile.rb uses the user-controlled...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via unvalidated workspace outputPath handling in WorkspaceConfigurationStorageService and BaseApiConsumerConfiguration during kiota client generate and kiota plugin generate. An attacker can make Kiota write generate...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via unvalidated workspace outputPath handling in WorkspaceConfigurationStorageService and BaseApiConsumerConfiguration during kiota client generate and kiota plugin generate. An attacker can make Kiota write generate...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the LanguageInformation handling in Kiota.Builder.Models.LanguageInformation and GenerationConfiguration when it reads x-ms-kiota-info clientClassName and clientNamespaceName values. An attacker can overwrite...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the LanguageInformation handling in Kiota.Builder.Models.LanguageInformation and GenerationConfiguration when it reads x-ms-kiota-info clientClassName and clientNamespaceName values. An attacker can overwrite...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through PluginsGenerationService in the plugin manifest generation code. An attacker can make the generated Copilot or Teams plugin manifest reference files outside the plugin package by supplying an OpenAPI...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the OpenApiDocumentDownloadService and KiotaBuilder document-loading path. An attacker can trigger SSRF, remote file inclusion, and local file inclusion by supplying a spec whose $ref points to an...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through PluginsGenerationService in the plugin manifest generation code. An attacker can make the generated Copilot or Teams plugin manifest reference files outside the plugin package by supplying an OpenAPI...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the OpenApiDocumentDownloadService and KiotaBuilder document-loading path. An attacker can trigger SSRF, remote file inclusion, and local file inclusion by supplying a spec whose $ref points to an...

CVE-2026-59866

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when kiota...

CVE-2026-47729 Squid: Memory disclosure in FTP gateway

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway src/clients/FtpGateway.cc, Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed...

CVE-2026-47729 Squid: Memory disclosure in FTP gateway

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway src/clients/FtpGateway.cc, Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed...

EUVD-2026-44962

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway src/clients/FtpGateway.cc, Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed...

CVE-2026-47729

CVE-2026-47729 affects Squid, a web caching proxy. Before 7.6, the FTP gateway (src/clients/FtpGateway.cc) could perform an out-of-bounds read when a directory listing entry date in TypeA/TypeB formats wasn’t followed by a filename, allowing memory disclosure from unrelated transactions. The issu...