1157960 matches found
CVE-2026-53840 OpenClaw < 2026.5.12 - Custom Header Leakage via MCP Streamable HTTP Cross-Origin Redirects
OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP endpoint can redirect requests to exfiltrate sensitive headers lik...
CVE-2026-53840 OpenClaw < 2026.5.12 - Custom Header Leakage via MCP Streamable HTTP Cross-Origin Redirects
OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP endpoint can redirect requests to exfiltrate sensitive headers lik...
CVE-2026-53840
OpenClaw CVE-2026-53840 affects the OpenClaw MCP stack before version 2026.5.12. The issue is an information-disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. If an attacker controls or can compromise an MCP end...
CVE-2026-53840 OpenClaw < 2026.5.12 - Custom Header Leakage via MCP Streamable HTTP Cross-Origin Redirects
OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP endpoint can redirect requests to exfiltrate sensitive headers lik...
MAL-2026-5911 Malicious code in utils-common-helpers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6999f05f6036baf4f6d45de0c55c6dd63452dc59ab6ebcbad0ffebf93e60584 package.json declares a postinstall lifecycle hook that runs curl -s http://8.140.205.78 -o /dev/null on every install. The package's only functional...
Malicious code in utils-common-helpers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6999f05f6036baf4f6d45de0c55c6dd63452dc59ab6ebcbad0ffebf93e60584 package.json declares a postinstall lifecycle hook that runs curl -s http://8.140.205.78 -o /dev/null on every install. The package's only functional...
MAL-2026-5909 Malicious code in react-hook-use-debounce-throttle-12 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0a4d8a0470a3e7fcb2da7cdb29ba6412125924a486aa6f4a437ccfbeb5ca4af package.json declares a postinstall hook that runs node -e to issue an HTTPS request to the bare IP 8.140.205.78 on port 80 with all errors silently...
Malicious code in react-hook-use-debounce-throttle-12 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0a4d8a0470a3e7fcb2da7cdb29ba6412125924a486aa6f4a437ccfbeb5ca4af package.json declares a postinstall hook that runs node -e to issue an HTTPS request to the bare IP 8.140.205.78 on port 80 with all errors silently...
Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.19.19 security, enhancement & bug fix update
Red Hat OpenShift Data Foundation 4.19.19 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.19.19 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-7063: RHODF 4.19.19 release DFBUGS-7062: Backport to 4.19.z ODF Console is breaking DFBUGS-7047: Backport...
Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.20.14 security, enhancement & bug fix update
Red Hat OpenShift Data Foundation 4.20.14 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.20.14 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-7104: Backport to 4.20.z CLONE - ODF Console is breaking DFBUGS-7079: NooBaa upgrade failure due to...
MAL-2026-5907 Malicious code in chai-solidity-testkit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f6482febfb9b57ff5c59a2170dab31ec0dd814ccc21b6996dbb9e7a0c9e575c The package masquerades as a Web3/Solidity testing toolkit but its shipped source is an unrelated stream-pipeline library plus a hidden payload runne...
Malicious code in chai-solidity-testkit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f6482febfb9b57ff5c59a2170dab31ec0dd814ccc21b6996dbb9e7a0c9e575c The package masquerades as a Web3/Solidity testing toolkit but its shipped source is an unrelated stream-pipeline library plus a hidden payload runne...
MAL-2026-5890 Malicious code in @dsft/ft-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80ec07b8de5ed0e8cf43a8584075210d47e80e7bcc04368a5029f7637188db3 The package is a dependency-confusion proof-of-concept squatting on the @dsft/ scope. Its package.json declares a preinstall hook that runs index.js,...
Malicious code in @dsft/ft-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a80ec07b8de5ed0e8cf43a8584075210d47e80e7bcc04368a5029f7637188db3 The package is a dependency-confusion proof-of-concept squatting on the @dsft/ scope. Its package.json declares a preinstall hook that runs index.js,...
CVE-2026-50020 vulnerabilities
Vulnerabilities for packages: pinot-fips, logstash-fips, thingsboard, knative-kafka-broker, pinot, keycloak, opensearch, wildfly, hadoop-fips, druid, apache-hop, spark-kubernetes-operator, kayenta-fips, commercial-elasticsearch, strimzi-kafka-operator-fips, apache-pulsar, wazuh-indexer,...
CVE-2026-50560 vulnerabilities
Vulnerabilities for packages: pinot-fips, thingsboard, knative-kafka-broker, opensearch, hadoop-fips, druid, apache-hop, spark-kubernetes-operator, kayenta-fips, commercial-elasticsearch, strimzi-kafka-operator-fips, apache-pulsar, wazuh-indexer, kafbat-ui-fips, kserve-modelmesh,...
GHSA-563Q-J3CM-6JXM vulnerabilities
Vulnerabilities for packages: pinot-fips, thingsboard, knative-kafka-broker, opensearch, hadoop-fips, druid, apache-hop, spark-kubernetes-operator, kayenta-fips, commercial-elasticsearch, strimzi-kafka-operator-fips, apache-pulsar, wazuh-indexer, kafbat-ui-fips, kserve-modelmesh,...
GHSA-HVCG-QMG6-JM4C vulnerabilities
Vulnerabilities for packages: pinot-fips, logstash-fips, thingsboard, knative-kafka-broker, pinot, keycloak, opensearch, wildfly, hadoop-fips, druid, apache-hop, spark-kubernetes-operator, kayenta-fips, commercial-elasticsearch, strimzi-kafka-operator-fips, apache-pulsar, wazuh-indexer,...
New Rokarolla Android Malware Steals PINs, SMS Codes, and Crypto Wallet Funds
Security researchers at Zimperium's zLabs have documented a new Android banking trojan, Rokarolla , that targets 217 banking and cryptocurrency apps and packs 137 remote commands. Together, they give an operator near-total control of an infected phone: it lifts lock-screen PINs, reads and sends...
BIT-PARSE-2026-53726 Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.80 and 9.9.1, a relation query using the $relatedTo operator could read the membership of a Relation field even when that field was hidden from the requesting client by...