GHSA-5MCX-8CMV-FVGX vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu...

CVE-2026-23459 vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu...

CVE-2026-43391 vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu...

CVE-2026-45991 vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu...

GHSA-M424-X6WR-WWGW vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu...

GHSA-J57X-5H9F-J263 vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-gcp...

CVE-2026-43310 vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-gcp...

GHSA-WVCW-5XVM-Q83M vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-gcp...

GHSA-9J35-6CP9-6X6G vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-gcp...

CVE-2026-23374 vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu...

GHSA-986C-6CJH-R8FC vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu...

GHSA-W447-HXJ8-XQ6P vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu...

GHSA-W776-5FWP-835Q vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-qemu...

CVE-2026-53009 vulnerabilities

Vulnerabilities for packages: linux-qemu, linux-gcp...

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

GHSA-WMJ8-9953-VFF5 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

Malicious code in process-status-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afd09cd68063b99549f252d3db30b88d9eb4c9e479c784ad0c09ce063764d768 [email protected] is an empty stub index.js exports , empty author/description, suspicious version 99.9.1 whose sole material effect on...

Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read

xAI's Grok Build coding CLI was uploading entire Git repositories, full commit history and all, to a Google Cloud Storage bucket run by xAI, not just the files a coding task needed. A researcher publishing as cereblab, testing version 0.2.93, captured one of those uploads, cloned the git bundle o...

MAL-2026-10553 Malicious code in home-mp-commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 885b9dad73e9eeb07a1fcb4a94493ec85573f656f7b9347a8682f56db359cfd6 [email protected] is an empty npm package declared main index.js is absent from the tarball whose sole effect on install is to resolve a single...

MAL-2026-10443 Malicious code in home-sections-web-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e6c206f8844e1ff870876bc1ac8cdf2b10ee2c36caf61883eb5a8f03caa5405 package.json declares the dependency ltidisafe as a direct tarball URL https://storage.googleapis.com/lscunpentest/packuxfoundry.tgz hosted on an...