MAL-2026-10750 Malicious code in telemetry-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cd215db682d2cc6eb6c9d4f5f704b66503762047ac210160f07559c07e93dea [email protected] impersonates @telemetry-js/telemetry — its package.json repository/homepage/bugs and README badges all reference the legitima...

MAL-2026-10723 Malicious code in @yeaft/webchat-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f9c505d42f1b2b4f64592abbf753ebf4b8eb5e11d359bc4fb8b8a9a9db3ec36e On startup the agent opens a WebSocket to a configurable server SERVERURL / config.serverUrl, default ws://localhost:3456 and dispatches...

MAL-2026-10746 Malicious code in sakuraai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0910c3572d73bd98775851cb79032ba00dbceda2de969b25f04a7a7d1ddfe4e When the daemon is started e.g. via sakura daemon start, the package binds an HTTP+WebSocket server on 0.0.0.0 and additionally exposes it via a...

MAL-2026-10753 Malicious code in a3s-code (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6062cbfbdc0c31c48564e4ec850d2ce71996d6cf12373c775aed5560c88e5434 On first import a3scode, top-level init.py invokes bootstrap.ensurenativeloaded, which performs an HTTP GET to...

SUSE CVE-2026-45793

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration validates GitHub OAuth tokens with the regex ^.A-Za-z0-9+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUBTOKEN values using t...

GHSA-W447-HXJ8-XQ6P vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-gcp...

CVE-2026-54504

creationtimestamp| type| source ---|---|--- 2026-07-16 00:35:05+00:00| published-proof-of-concept| https://github.com/andrea9293/mcp-documentation-server/security/advisories/GHSA-6f5r-5672-72j7...

CVE-2026-58196

creationtimestamp| type| source ---|---|--- 2026-07-16 00:35:03+00:00| published-proof-of-concept| https://github.com/stacklok/toolhive/security/advisories/GHSA-pr64-jmmf-jp54...

CVE-2026-54450

creationtimestamp| type| source ---|---|--- 2026-07-15 22:35:03+00:00| published-proof-of-concept| https://github.com/stacklok/toolhive/security/advisories/GHSA-pph6-vfjv-vpjw...

CVE-2026-55576

MaaAssistantArknights is a one-click tool for daily Arknights tasks. In the current dev-v2 workflow, .github/workflows/release-preparation.yml inlined attacker-controlled github.event.pullrequest.title into a run: shell command during the pullrequest opened, reopened, and readyforreview events, s...

CVE-2026-55576

The CVE-2026-55576 entry concerns MaaAssistantArknights. In the dev-v2 workflow, the string from github.event.pull_request.title was inlined into a run: shell command in .github/workflows/release-preparation.yml for PRs opened, reopened, or ready_for_review. A non-draft fork PR with a title start...

GHSA-Q3FV-X8VG-QQM4 vulnerabilities

Vulnerabilities for packages: trivy-operator...

GHSA-39PV-4J6C-2G6V vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

GHSA-5WVM-RXCF-6CG8 vulnerabilities

Vulnerabilities for packages: kubeflow-katib...

CVE-2026-54491

creationtimestamp| type| source ---|---|--- 2026-07-15 18:35:12+00:00| published-proof-of-concept| https://github.com/koel/koel/security/advisories/GHSA-6qvr-wjmv-v8mm...

CVE-2026-54451

creationtimestamp| type| source ---|---|--- 2026-07-15 18:35:03+00:00| published-proof-of-concept| https://github.com/elixir-protobuf/protobuf/security/advisories/GHSA-rv48-qqj5-crxg...

CVE-2026-50562

FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from untrusted pull request code in .github/workflows/preview-docs-build.yml and .github/workflows/preview-fastgpt-build.yml can be downloaded by privileged...

CVE-2026-45793

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration validates GitHub OAuth tokens with the regex ^.A-Za-z0-9+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUBTOKEN values using t...

UBUNTU-CVE-2026-45793

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration validates GitHub OAuth tokens with the regex ^.A-Za-z0-9+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUBTOKEN values using t...

CVE-2026-50562

FastGPT is a knowledge-based AI application platform. At commit 22ebfacbb43311e9b73294040ae0eb87390c6bba and earlier, artifacts built from untrusted pull request code in .github/workflows/preview-docs-build.yml and .github/workflows/preview-fastgpt-build.yml can be downloaded by privileged...