Malicious Package

Overview node-env-buffer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in @client-web-next/env-util (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16499 Malicious code in @client-web-next/env-util (npm)

--- -= Per source details. Do not edit below this line.=-...

PT-2026-97131

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.0 Description In the OpenBao Agent's exec rendering mode, secrets defined in the env template may be written to standard output. This occurs when the system re-creates the template runner following repeated...

Updated python-configargparse packages fix security vulnerabilities

Config file or environment variable can trigger writing out a config file, overwriting an arbitrary file and disclosing configuration values...

GHSA-W34Q-CM8F-9C5X OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

Summary The OTLP log gRPC exporter loads TLS settings from environment variables but does not apply them when creating gRPC transport credentials. Operators who rely on OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, or related client certificate variables for CA pinning or mTLS get...

OpenTelemetry-Go: Log gRPC exporter ignores env TLS certs, bypassing mTLS/pinning

Summary The OTLP log gRPC exporter loads TLS settings from environment variables but does not apply them when creating gRPC transport credentials. Operators who rely on OTELEXPORTEROTLPLOGSCERTIFICATE, OTELEXPORTEROTLPCERTIFICATE, or related client certificate variables for CA pinning or mTLS get...

GHSA-HPJ9-GRJP-7VC7 Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Summary Kestra's Micronaut management endpoints are served on port 8081 with no authentication, even when the main API port 8080 has basic-auth enabled. Anyone who can reach :8081 can read GET /env full resolved environment/configuration and mutate runtime state via POST /loggers/name change log...

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 (/env, /loggers) bypass API basic-auth

Summary Kestra's Micronaut management endpoints are served on port 8081 with no authentication, even when the main API port 8080 has basic-auth enabled. Anyone who can reach :8081 can read GET /env full resolved environment/configuration and mutate runtime state via POST /loggers/name change log...

askbob (>=0.0.3, <=0.0.4), cde (0.2.0.1) +12 more potentially affected by CVE-2026-85078 via sanic (20.9.0)

sanic PYPI version 20.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on sanic and may be impacted: - askbob =0.0.3, =0.0.19, =0.1.1, =0.3.26, =0.10.25, =2.2.10, =0.0.1, =0.2.1, =0.2.2 - sanic-sockjs 0.1.0 - sstool-general 0.0.4 - vma-nlu 1.1.6 Source...

github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 — /etc/passwd Injection via HOME env

A flaw was found in CRI-O. The fix for a previous vulnerability CVE-2022-4318 was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitra...

EUVD-2026-81291

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does...

RHCOS 4 : OpenShift Container Platform 4.12.98 (RHSA-2026:65906)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:65906 advisory. - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 /etc/passwd Injection via HOME env CVE-2026-15809 -...

CVE-2026-92591

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does...

CVE-2026-92591 Craft CMS 5.0.0 before 5.10.13 Environment Secret Exposure via Installer

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does...

CVE-2026-92591

Craft CMS versions 5.0.0 through 5.10.12 misinterpret a database connection failure as the application being uninstalled, exposing anonymous installer actions (e.g., install/validate-site) on a production site. The installer's site-name field is serialized through Site::getName(), which expands $...

Malicious code in praetorian-mind-rce-test-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7a16a607fd396ce7218fb45728cb3ca55f541326c83a063668a7a170b46acc1 At pip install time, setup.py calls a phonehome routine at module top-level before setup runs. The routine collects extensive host and container...

MAL-2026-16223 Malicious code in @traktis/environment (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b9bdabc95f4e8bc70e348557c1cae7d2447d9bd1405ac7a23945ded47ec04a8 package.json declares preinstall and postinstall lifecycle scripts that invoke curl against the hardcoded cleartext endpoint...

PT-2026-94108

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0 through 5.10.12 Description A failure in the database connection is incorrectly interpreted as the software not being installed. This allows anonymous installer actions, such as install/validate-site, to be accessed on...

MAL-2026-16176 Malicious code in fulfillment-cuprum-auth-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 06df6767178d76043d26df04fcbe4e8de2f579d38e96f52a04346c04a6dda565 The package's preinstall script index.js runs automatically on npm install and collects host identifiers via os.hostname, os.userInfo, os.homedir, an...