MAL-2026-6194 Malicious code in portloop (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e745a79c5fb952105d93cc5d5f37bc77af9cc08d9a021f09a12d26416a29de3c On default invocation e.g., npx portloop with no flags, the CLI runs in daemon+quiet+respawn mode and POSTs id, hostname, host, url, port, user to a...

GHSA-G7M4-839X-CH6V

creationtimestamp| type| source ---|---|--- 2026-06-19 03:11:39+00:00| seen| https://gist.github.com/alon710/9444ec80b5b6b03e92361b8cc9ab95ef...

CVE-2026-25119

creationtimestamp| type| source ---|---|--- 2026-06-19 02:22:56+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-w6j9-vw59-27wv...

CVE-2026-52807

creationtimestamp| type| source ---|---|--- 2026-06-19 02:19:30+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-vcm5-gvmp-78mp...

CVE-2026-52811

creationtimestamp| type| source ---|---|--- 2026-06-19 02:18:08+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-89mr-xqfv-758m 2026-06-24 22:53:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2yysdqds2t...

CVE-2026-52812

creationtimestamp| type| source ---|---|--- 2026-06-19 02:17:49+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-6p9m-q3jp-47h4 2026-06-24 22:38:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2y72dynn2f...

CVE-2026-52813

creationtimestamp| type| source ---|---|--- 2026-06-19 02:17:38+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-c39w-43gm-34h5 2026-06-24 23:03:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2zkpdboz2l 2026-06-30 17:00:16+00:00|...

PT-2026-51010

Name of the Vulnerable Software and Affected Versions AWX affected versions not specified Description A flaw exists in the GitHub webhook integration where the controller stores the pull request.statuses url value from a pull request webhook payload without validating if it points to a trusted...

CVE-2026-46699

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories through GitHub...

CVE-2026-46699

CVE-2026-46699 affects the conda-smithy tool. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories due to using mutable GitHub usernames as identifiers for repository invitation routing, instead of stable GitHu...

CVE-2026-46699 conda-smithy vulnerable to misrouted repository invitation by conda-forge-webservices[bot] due to GitHub username takeover leading to unintended write access in conda-forge feedstock repository

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories through GitHub...

CVE-2026-46699 conda-smithy vulnerable to misrouted repository invitation by conda-forge-webservices[bot] due to GitHub username takeover leading to unintended write access in conda-forge feedstock repository

conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.61.0, a vulnerability in the conda-forge automated webservices allowed unintended write access to feedstock repositories through GitHub...

GHSA-R7G4-QG5F-QQM2 vulnerabilities

Vulnerabilities for packages: langfuse...

CVE-2026-54499

creationtimestamp| type| source ---|---|--- 2026-06-18 19:32:55+00:00| published-proof-of-concept| https://github.com/stanfordnlp/stanza/security/advisories/GHSA-v5jw-96jm-7h2c 2026-07-09 01:20:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mq6hrarjta2z...

ROOT-APP-GOBINARY-CVE-2026-27889 CVE-2026-27889 in rootio-github.com/nats-io/nats-server/v2 - Patched by Root

Root has patched CVE-2026-27889 in the rootio-github.com/nats-io/nats-server/v2 package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-CVE-2025-15558 CVE-2025-15558 in rootio-github.com/docker/cli - Patched by Root

Root has patched CVE-2025-15558 in the rootio-github.com/docker/cli package for Root:Go. Multiple fixed versions available...

GHSA-W5CV-PW74-4RXC opentelemetry-collector-contrib: githubreceiver silently ignores configured required_headers authentication

githubreceiver Silently Ignores Configured requiredheaders Authentication Summary The githubreceiver webhook handler does not enforce the requiredheaders configuration. Headers are validated at startup config rejects empty keys/values but never checked on incoming requests. This follows the same...

opentelemetry-collector-contrib: githubreceiver silently ignores configured required_headers authentication

githubreceiver Silently Ignores Configured requiredheaders Authentication Summary The githubreceiver webhook handler does not enforce the requiredheaders configuration. Headers are validated at startup config rejects empty keys/values but never checked on incoming requests. This follows the same...

GHSA-RVP7-W75Q-9FV2 BBOT: Symlink-Following Arbitrary Write via github_workflows Module

The githubworkflows module constructs local directory paths from user-controlled repository names without validating for symlinks. A local attacker sharing the scan directory can plant a symlink at the predictable output path, causing workflow data to be written to an attacker-chosen location...

Insufficiently Protected Credentials

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the backup process. An attacker can obtain sensitive account credentials and configuration secrets by...