Malicious code in smart-npv-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed380f25fe3e135a6b64fabefc448b561908023a5279373b49716cf2b991ee6e The package ships lib/report.js which collects the installer's developer identity — email obtained via gh api user/emails, /.gitconfig, npm config, a...

Malicious code in install-native-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 757eb666248556142f82ce2793cd42e7e30db4ce65efc823eaed2a71c14087f2 lib/report.js collects host and user identifying data via os.hostname, os.userInfo, execSync-invoked system commands, and fs.readFileSync of local...

MAL-2026-11468 Malicious code in install-native-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 757eb666248556142f82ce2793cd42e7e30db4ce65efc823eaed2a71c14087f2 lib/report.js collects host and user identifying data via os.hostname, os.userInfo, execSync-invoked system commands, and fs.readFileSync of local...

@apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header

Summary When prettyUrls: true is enabled on @apostrophecms/file a documented SEO feature for serving uploaded files at clean URLs, the public pretty-URL handler builds the upstream URL using the raw Host HTTP request header: js proxyUrl = $req.protocol://$req.get'host'$uglyUrl That URL is then...

NPM: @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header

NPM: @apostrophecms/file pretty-URL Vulnerable to Unauthenticated SSRF via Host header vulnerability discovered by ? in WordPress Npm apostrophe versions = 4.30.0...

MAL-2026-11421 Malicious code in asdk-plugin-ai-platform (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ba38202b0196fc58518ffc2cb0c0cd9067da9fec70d6bb371119b8175893b416 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-11422 Malicious code in asdk-plugin-alphagen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d3479f5a67e780468835828895609215d82aa5a273dfc152e4bae5a12f21a245 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-11423 Malicious code in asdk-plugin-legacy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 65dd9dd087b805a16fb5d68c92cf2be0ec28fec162d75bb0eb81bb8d9bcfb61a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Interpretation Conflict

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Interpretation Conflict due to malformed authority introducer handling in parseWithStatus and resolve in index.js. An attacker can bypass host-based URL checks and steer requests to an...

Interpretation Conflict

Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Interpretation Conflict due to malformed authority introducer handling in parseWithStatus and resolve in index.js. An attacker can bypass host-based URL checks and steer...

Malicious code in eth-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d7fbf15a08eb3568d462e06fa345cfdb59afe88bf38b63e47ecea29ea92c009 The package presents itself as an Ethereum bridge library but its index.js is a verbatim copy of the well-known eth-sig-util signature utility...

CVE-2026-18446

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...

CVE-2026-18446

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...

UBUNTU-CVE-2026-18446

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...

CVE-2026-18446 fast-uri vulnerable to host confusion via backslash authority introducer

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...

CVE-2026-18446 fast-uri vulnerable to host confusion via backslash authority introducer

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...

CVE-2026-18446

CVE-2026-18446 affects the fast-uri library prior to versions 4.1.2, 3.1.5, and 2.4.4 . A backslash-based introducer can substitute for a literal double forward slash required to recognize a URI authority, causing fast-uri to misparse the host while Node’s WHATWG URL parser treats backslashes dif...

CVE-2026-18446 fast-uri vulnerable to host confusion via backslash authority introducer

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...

MAL-2026-11420 Malicious code in walmart-genai-trace (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7e84b4bbb5660ea5c7f803c4e5d0b12dfe41c9bb147fd2228c72bdda2224291a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2026-18206

A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain like .example.com to restrict which hosts can register or update clients. Due to improper validation, the...