22 matches found
external_expat-2.1.0_CVE-2022-25313
This repository does not have a README...
CVE-2026-70548
Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...
CVE-2026-70548 SSRF In CocoaPods Via JFrog Artifactory External Dependency
Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...
CVE-2026-70548
This SSRF vulnerability affects JFrog Artifactory (Self-Managed) through its External Dependency feature related to CocoaPods . Under specific circumstances, a low-privilege user can issue requests to remote CocoaPods repositories, potentially leveraging Artifactory as a proxy. The CVSS v3.1 scor...
CVE-2026-70548 SSRF In CocoaPods Via JFrog Artifactory External Dependency
Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...
EUVD-2026-65543
Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...
PT-2026-81353
Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...
CVE-2026-70548: Server-Side Request Forgery (SSRF)
Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency...
PT-2026-59030
The structure data endpoint in the Airflow UI returned external dependency graph nodes for linked Dags without checking whether the caller had read permission on those linked Dags. An authenticated UI/API user authorized for one Dag could enumerate linked Dag IDs and dependency metadata for other...
MAL-2026-10135 Malicious code in theta-sdk-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6967c021e95228b33b18be4489fea5d404720cbd21beb53dac8bf7ea4f4d54d1 [email protected] ships src/decrypt.js and src/providers/BaseProvider.js which together implement a hidden execution channel. On module load,...
Malicious code in via-city-tools-m-particle (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc5c4f690e0399edc4408e7729291803db7916ed764bcfe16988f4cdccd5cfc1 The package exports an empty object module.exports = and has no functionality of its own. Its only substantive effect is to declare a dependency on...
MAL-2026-1525 Malicious code in peer-deps-external (npm)
The package 'peer-deps-external' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...
Malicious Package
Overview peer-deps-external is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior The...
Malicious Package
Overview no-type-assertion is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior The...
Malicious Package
Overview transform-dynamic-import is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior...
Malicious Package
Overview better-styled-components is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior...
Malicious Package
Overview minify-mangle-names is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior The...
Malicious Package
Overview urql-introspection is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior The...
