1434 matches found
Grok Build Uploaded Entire Git Repositories to xAI Storage, Not Just Files It Read
xAI's Grok Build coding CLI was uploading entire Git repositories, full commit history and all, to a Google Cloud Storage bucket run by xAI, not just the files a coding task needed. A researcher publishing as cereblab, testing version 0.2.93, captured one of those uploads, cloned the git bundle o...
MAL-2026-10553 Malicious code in home-mp-commons (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 885b9dad73e9eeb07a1fcb4a94493ec85573f656f7b9347a8682f56db359cfd6 [email protected] is an empty npm package declared main index.js is absent from the tarball whose sole effect on install is to resolve a single...
Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)
Stored Cross-Site Scripting XSS in the genai/evalsvisualization component of Google Cloud Vertex AI SDK google-cloud-aiplatform versions from 1.98.0 up to but not including 1.131.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's Jupyter or Colab environment...
MAL-2026-10443 Malicious code in home-sections-web-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e6c206f8844e1ff870876bc1ac8cdf2b10ee2c36caf61883eb5a8f03caa5405 package.json declares the dependency ltidisafe as a direct tarball URL https://storage.googleapis.com/lscunpentest/packuxfoundry.tgz hosted on an...
CVE-2026-14934
A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tena...
CVE-2026-14934
A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tena...
EUVD-2026-43338
A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tena...
CVE-2026-14934
CVE-2026-14934 affects Google Cloud BigQuery, Dataform and Colab Enterprise repository creation functionality. A Missing Authorization flaw in versions from October 2025 through May 10, 2026 allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover. The ...
Malicious code in frontend-regulations (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d88817d57907505adf7d303019c78adceb6da7bedf1e3416f2b9a1e80605ca1 [email protected] is a near-empty wrapper index.js exports an empty object whose package.json declares the dependency 'ltidisafe' with the...
MAL-2026-10415 Malicious code in frontend-regulations (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d88817d57907505adf7d303019c78adceb6da7bedf1e3416f2b9a1e80605ca1 [email protected] is a near-empty wrapper index.js exports an empty object whose package.json declares the dependency 'ltidisafe' with the...
Malicious code in notifications-broadcast (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bd1aba4582464347961d36f63f501a5aaf2c190322e7ab8d8e4231c076b817e2 [email protected] ships an empty index.js module.exports = ; with placeholder metadata empty description, empty author, version 99.9.1...
MAL-2026-10421 Malicious code in portway (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e04dc52cd77658d168578535fb67d77ea76de79beadb77e14c96f023f4e51772 package.json declares the dependency 'ltidisafe' as a direct https tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.3.2.tgz...
Malicious code in portway (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e04dc52cd77658d168578535fb67d77ea76de79beadb77e14c96f023f4e51772 package.json declares the dependency 'ltidisafe' as a direct https tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.3.2.tgz...
Malicious code in sso-users-detection (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc80441472ec24451f83aebdc186d5bc532ddadaac8888d3d30b72c17c94f993 [email protected] is a hollow package main exports , empty author/description, inflated 99.9.1 version whose sole effect on install is to pu...
CVE-2026-14934: Missing Authorization
A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tena...
PT-2026-57802
A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tena...
MAL-2026-10198 Malicious code in polylabel-web-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce7df46acd8236fafbaa27dbccb92d1f286c17b023ea5ff555700e76c4a0188f [email protected] ships an empty index.js stub and declares its only runtime dependency as a direct tarball URL on a Google Cloud Storage...
CVE-2026-61448: Unrestricted Upload of File with Dangerous Type
Parse Server is affected by a stored cross-site scripting XSS vulnerability in versions = 9.0.0, 9.10.0-alpha.2 and = 8.6.83. When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type. A malformed Content-Type that is not a...
PT-2026-57441
Name of the Vulnerable Software and Affected Versions Parse Server versions 9.0.0 through 9.10.0-alpha.1 Parse Server versions 8.x through 8.6.83 Description A stored cross-site scripting XSS issue exists when the software fails to recognize an uploaded file's extension via the mime package,...
