CVE-2026-14538: Improper Authorization

An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enfor...

MAL-2026-11299 Malicious code in ethers.jsonn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acfd52ff30b26f15be66cbf87a098dde096288d776d0be4ecd555ac81e229f81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rshell (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5111add8e3d97e54c2903e39496ddb07c74aa68af8e7f0f1bee761c320dd7ebb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in api-gateway-lambda-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a257fe33bb475cd07d71ded069ceec397276bdd4eecbf78b50d81bde8da769e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11311 Malicious code in files-bucket-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7cf44dfe5c7f3bade4732122da576e8f2801c9c493a2e45ee60f16a6cde3233c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11283 Malicious code in dsilva-react-module-seed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e6a8391609d3660eb97edc5c301beb1c8d644032e8387a33513121c2bcf70da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11248 Malicious code in blbird (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4116fb9fa0f1722871be8fd4fdc1d54633acc0f32aea0c74372ed72b2a147d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11384 Malicious code in spectral-corsair (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7c77441a8038182fe252b5782f82b900831bb6e4b598944ed0edfb4093e5fe1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11330 Malicious code in malxios (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cadf321b289a01aebfd33821cffbdeeaa827aa5bf4c110eacdf26b6b7654197 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11233 Malicious code in @web3-util/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b6c5241d80dc8baa902550a561e37b238c483430f8c7b186abe033d11f8ea34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @solana-utils/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware abda158dfd80788df38b2221a5a9715eb7d6bebadb9569cfc51774985f39b0fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-53913 — Updated!

CVE-2026-53913 — camel-keycloak Fail-Open Authentication Bypass Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus|...

MAL-2026-11316 Malicious code in hjw-nasa-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b1632ded6ca00645c902a9d691d08823c53920ffd804e142b535efbca479664 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11337 Malicious code in ncc-hyperapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9647de0608c8fb354bb4e857f6649f8e617ae5e05055d108cc6ae44f9427897a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in testsetset (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7e0887bc4462a3a2fdae3c468f85da3352d2ae5a196bbbeca6cf072caf5e3f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11364 Malicious code in reac.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a475a8f4fcdabfeeaab666f2e7ab900248f71d15004601f7d0e5fb2e02ecc1c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uniswapintefrace (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5cd5488070442a7d4759895cd6b5243add2626b095f5da7cb1c08611c396e605 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11363 Malicious code in raydiums (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3fbaa5dc6f9b4df46fcb491e1a31924b028376844d5678688289fbae08b7099 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tgnode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94acf1d28e1b8f8aa5afe5698d86dfc51989a56d5ccb99d848d2286b61dc21b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11399 Malicious code in tgnode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94acf1d28e1b8f8aa5afe5698d86dfc51989a56d5ccb99d848d2286b61dc21b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...