Critical: amazon-ssm-agent

Issue Overview: Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. CVE-2026-42505 go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2...

Critical: amazon-ssm-agent

Issue Overview: Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. CVE-2026-42505 go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2...

MAL-2026-17265 Malicious code in @hrmony/kit-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6ac778d35433101385eb57755b6079e76c7bb3dc40306218cf5b1295d5a853 The package runs credential-harvesting code both at install time and at import time. The declared preinstall hook scripts/check-setup.mjs queries the...

MAL-2026-17249 Malicious code in @hrmony/account-management (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67b699bc4a206505ba0cf224888996e37fe00dff5ffb737e3b95b9fd139b910f The main module executes on require/import via a top-level await. It queries the AWS IMDSv2 metadata service at 169.254.169.254 to retrieve instance...

Malicious code in @hrmony/benefit-mobilitaet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf87d41e53e59a65644aaf92de291a5943afa017fbdc2068ebb6741383f60688 On module load, index.js unconditionally contacts the EC2 Instance Metadata Service at 169.254.169.254, obtains an IMDSv2 token, and retrieves instan...

MAL-2026-17255 Malicious code in @hrmony/benefit-mobilitaet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf87d41e53e59a65644aaf92de291a5943afa017fbdc2068ebb6741383f60688 On module load, index.js unconditionally contacts the EC2 Instance Metadata Service at 169.254.169.254, obtains an IMDSv2 token, and retrieves instan...

Malicious code in @hrmony/mailer-pladddform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc17a6ae94f3beee4d60886e3233b210660bcd01f6c5f6d2fff840e6d385973b index.js executes at top-level import and performs three credential-harvesting flows directed at...

MAL-2026-17268 Malicious code in @hrmony/mailer-pladddform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc17a6ae94f3beee4d60886e3233b210660bcd01f6c5f6d2fff840e6d385973b index.js executes at top-level import and performs three credential-harvesting flows directed at...

MAL-2026-17277 Malicious code in @hrmony/pladddform-infrastructure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a26b9f2a46bdc8abd9882683d792c8fff6d94a9b89cc68162339e7fede47ceb On any require/import of @hrmony/pladddform-infrastructure, top-level code POSTs a beacon to the hardcoded attacker endpoint...

PT-2026-96798

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.18.0 Description An authenticated user with remote-download access can perform a Server-Side Request Forgery SSRF by providing a specially crafted SrcUri through the RemoteDownloadTask.createDownloadTask function...

MAL-2026-16319 Malicious code in @dbbhk/ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 478839dda68d2c5eefa1a55557602d4b12396c988211b28d785af531d0b19d07 @dbbhk/[email protected] declares both preinstall and postinstall hooks in package.json that execute node callback.js, so the payload runs...

CVE-2026-89049: Server-Side Request Forgery (SSRF)

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...

CVE-2026-89049: Server-Side Request Forgery (SSRF)

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...

PT-2026-67838

Name of the Vulnerable Software and Affected Versions Open WebUI versions 0.9.0 through 0.10.0 Description Open WebUI fails to properly validate user-supplied URLs when checking if a destination is globally routable. The system applies ipaddress.is global to literal IPv6 addresses but does not...

CVE-2026-58468: Server-Side Request Forgery (SSRF)

NocoBase through 2.1.20 contains a server-side request forgery vulnerability in the serverRequest wrapper that allows authenticated administrators to issue arbitrary outbound HTTP requests by supplying malicious URLs to workflow request nodes, custom request action buttons, or the AI plugin...

CVE-2026-27826

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to version 0.17.0, an unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL b...

PT-2021-8867

Name of the Vulnerable Software and Affected Versions OpenShift Container Platform 4 affected versions not specified Description A flaw was discovered where users with access to create pods also have the ability to schedule workloads on master nodes. Pods with permission to access the host networ...