Malicious code in godzzz (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39f05673527822a16dc88d65a9ff9471548f8046fc28c7930fd8958dbcc38f3a The npm package [email protected] ships cdpinject.js which imports http, https, childprocess and fs at the top of the file, reads process.env including...

Malicious code in catqrcodeconverter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3333f7b95e551ebf6ed266fb1de661b7419520ed3a922b05910ede132c7d6757 Package [email protected] wires both preinstall and postinstall lifecycle hooks in package.json to execute scripts/run.js. On npm install,...

Windows Host Security Configuration Reporter

This plugin aggregates Windows host security configuration settings collected by individual detection plugins and reports the result as a structured internal host tag. The structured data object is reported even when only a subset of the source plugins ran. %NASLMINLEVEL 80900 C Tenable, Inc...

Linux Distros Unpatched Vulnerability : CVE-2026-92382

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer...

PT-2026-97204

Name of the Vulnerable Software and Affected Versions Apache BuildStream versions prior to 2.8.1 Description An improper link resolution issue exists in the tar source plugin when running on Python versions prior to 3.12. This allows malicious source tarballs to write files on the host system wit...

host-metering security update

1.2.0-4.0.3 - Rebuild with latest go-toolset-1.19-golang to fix CVE-2026-27145 Orabug: 39863765 1.2.0-4.0.1 - Rebuild with new go-toolset-1.19-golang to fix CVE-2026-32283 Orabug: 39352233...

AlmaLinux 9 : podman (ALSA-2026:69961)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69961 advisory. podman: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 podman: golang net/url: Denial of Service from quadratic...

PT-2026-97495

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The HostList.list function catches generic exceptions and returns the error string verbatim. An authenticated user can exploit this via the host filter parameter...

CVE-2026-96275: Improper Limitation of a Pathname to a Restricted Directory

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

CVE-2026-18505: URL Redirection to Untrusted Site

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to open redirect in the PMP HostHeaderFilter HostHeaderFilter.java:151. An unauthenticated attacker can craft a request with a manipulated Host header to redirect authenticated operators to attacker-controlled sites, enablin...

Malicious code in n8n-nodes-data-transformer-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocatio...

MAL-2026-16418 Malicious code in n8n-nodes-data-transformer-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77b996187dc49e5591ddf3cef428be3a9309e7f5bab48bd4698aed2be0c3dfb0 The package's postinstall.js runs automatically on npm install and combines childprocess.execSync with http/https.request and multiple curl invocatio...

MAL-2026-16414 Malicious code in @tvg-mar/storyblok-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5750ec8381c607c94fcf3c1530662ccef3b296753f9ace22e3f760e5fe9d58af The package's scripts.install runs node index.js, which loads a runtime bootstrap that reaches a 'telemetry probe' helper. The helper dynamically loa...

CVE-2026-77259 MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment opens a caller-selected server-local file without checking that the resolved path remains in the workspace. A caller can upload environment files,...

CVE-2026-77259 MCP Atlassian: Arbitrary file read via confluence_upload_attachment allows exfiltration of server credentials

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment opens a caller-selected server-local file without checking that the resolved path remains in the workspace. A caller can upload environment files,...

EUVD-2026-84758

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment opens a caller-selected server-local file without checking that the resolved path remains in the workspace. A caller can upload environment files,...

CVE-2026-77247 MCP Atlassian: Arbitrary server-local file upload to Jira/Confluence attachments via unrestricted file_path parameters

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending them as attachments. In remote or multi-user...

Malicious Package

Overview uolcs-host-uol-anuncios-fe is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CVE-2026-77274 MCP Atlassian: SSRF Protection Bypass

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validateurlforssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer in the header-based Jira and Confluence URL...

Malicious code in eslint-config-compact-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 414c7f8397efb591ffe6f87f9c44e8eb803606eb4789d357abe337d3225cc46f On require, index.js collects host reconnaissance data os.hostname, os.userInfo.username, os.platform, architecture, Node version, current working...