MAL-2026-4336 Malicious code in webservices.rest-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c9c78a4d0c87def69bbc5337e41a730e7ca6ae898426759915f053dc584581c package.json declares both preinstall and postinstall hooks that execute index.js, which exfiltrates installer data to a base64-encoded Cloudflare...

PT-2026-42589

Summary The Fission router registers an internal-style route — /fission-function/ and /fission-function// — for every Function object, independent of whether any HTTPTrigger exists for that function. The route was mounted on the same listener as user-defined HTTPTriggers svc/router, port 8888, so...

SQL Injection Vulnerabilities in Tickets

Tickets is an open-source public safety scheduling and tracking application developed by Open ISES. Versions of tickets prior to 3.44.2 contained a SQL injection vulnerability. This vulnerability stemmed from the fact that the values of latitude, longitude, callsign, mph, altitude, and timestamp,...

PT-2026-42513

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A SQL injection issue exists in the incs/remotes.inc.php file. The application fails to sanitize values parsed from external GPS tracking service XML/JSON responses, specifically for...

PT-2026-42581

Name of the Vulnerable Software and Affected Versions Concrete CMS versions prior to 9.5.1 Description Stored Cross-Site Scripting XSS occurs via the 'external-link' page cvName because the updateCollectionAliasExternal function bypasses sanitization. Stored XSS is a flaw where malicious scripts...

PT-2026-44140

Name of the Vulnerable Software and Affected Versions symfony/dom-crawler affected versions not specified Description The Crawler::addXmlContent function in symfony/dom-crawler sets DOMDocument::$validateOnParse to true before calling loadXML. This action re-enables libxml's DTD subset processing...

CVE-2024-32983

creationtimestamp| type| source ---|---|--- 2026-05-20 22:02:44+00:00| seen| https://bsky.app/profile/tesaguri.fedibird.com.ap.brid.gy/post/3mmcvqb4beh22...

MAL-2026-4675 Malicious code in supership-scan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0aebde5ba55a72b6d4c6917ccf22db1427d434fed04cecc22dd16844e2d39033 The package advertises itself as a local-only static analyzer README: "Runs locally. Your code never leaves the machine" and "What's never transmitte...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: gptscript, syft, witness, gomplate, pulumi-kubernetes-operator, skaffold, src-fingerprint, grafana-alloy, kubescape, kots, kyverno, kaniko, terragrunt, dagger, bom, gitlab-runner, wolfictl, pulumi, guac, pulumi-language-dotnet, act, scorecard, osv-scanner, argo-cd,...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: gptscript, syft, witness, gomplate, pulumi-kubernetes-operator, skaffold, src-fingerprint, grafana-alloy, kubescape, kots, kyverno, kaniko, terragrunt, dagger, bom, gitlab-runner, wolfictl, pulumi, guac, pulumi-language-dotnet, act, scorecard, osv-scanner, argo-cd,...

CVE-2026-45570 vulnerabilities

Vulnerabilities for packages: gptscript, syft, witness, gomplate, pulumi-kubernetes-operator, skaffold, src-fingerprint, grafana-alloy, kubescape, kots, kyverno, kaniko, terragrunt, dagger, bom, gitlab-runner, wolfictl, pulumi, guac, pulumi-language-dotnet, act, scorecard, osv-scanner, argo-cd,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: gptscript, syft, witness, gomplate, pulumi-kubernetes-operator, skaffold, src-fingerprint, grafana-alloy, kubescape, kots, kyverno, kaniko, terragrunt, dagger, bom, gitlab-runner, wolfictl, pulumi, guac, pulumi-language-dotnet, act, scorecard, osv-scanner, argo-cd,...

Malicious code in @aswinsparky/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8cceefd98563e2885501c896472471f2bb20b77103ad99c253775570cae6b4fe index.js line 11 issues a fetch to the hardcoded URL https://api.aswinsparky.qzz.io carrying values read from process.env. The destination is a...

GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: crossplane, nemo, argocd-image-updater, witness, grafana-alloy-fips, gitlab-runner-fips, amazon-ssm-agent, src-fingerprint-fips, grafana-alloy, upwind-agent, goreleaser, apko-fips, xeol-fips, kargo, external-secrets-operator-fips, syft, gitaly-fips, trivy, grype, cg,...

CVE-2026-45571 vulnerabilities

Vulnerabilities for packages: crossplane, nemo, argocd-image-updater, witness, grafana-alloy-fips, gitlab-runner-fips, amazon-ssm-agent, src-fingerprint-fips, grafana-alloy, upwind-agent, goreleaser, apko-fips, xeol-fips, kargo, external-secrets-operator-fips, syft, gitaly-fips, trivy, grype, cg,...

GHSA-M7CR-M3PV-HGRP vulnerabilities

Vulnerabilities for packages: crossplane, nemo, argocd-image-updater, witness, grafana-alloy-fips, gitlab-runner-fips, amazon-ssm-agent, src-fingerprint-fips, grafana-alloy, upwind-agent, goreleaser, apko-fips, xeol-fips, kargo, external-secrets-operator-fips, syft, gitaly-fips, trivy, grype, cg,...

CVE-2026-9101

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

CVE-2026-9101 Prototype pollution in csv parsing

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

CVE-2026-9101 Prototype pollution in csv parsing

Prototype pollution in csv parsing logic during import can lead to untrusted file paths but not arguments entering shell.openExternal after specific user behavior leading to "1-click" command execution...

CVE-2026-9101

The CVE-2026-9101 entry describes a prototype pollution flaw in CSV parsing during import. The underlying issue can allow untrusted file paths (not arguments) to reach shell.openExternal after specific user actions, potentially enabling a limited form of “1-click” command execution. Documents do ...