1157883 matches found
CVE-2026-47691 vulnerabilities
Vulnerabilities for packages: akhq, spark, camunda, infinispan, spark-kubernetes-operator-fips, s3proxy, apache-hop, kayenta, opensearch, strimzi-kafka-operator, apicurio-registry, celeborn, kayenta-fips, druid, management-api-for-apache-cassandra-4.0, trino, elasticsearch, airbyte-server-fips,...
GHSA-5X3R-WRVG-RP6Q vulnerabilities
Vulnerabilities for packages: grpc-java-fips, akhq, spark, camunda, infinispan, spark-kubernetes-operator-fips, neo4j, apache-hop, kayenta, opensearch, strimzi-kafka-operator, apicurio-registry, celeborn, docker-selenium, druid, kayenta-fips, management-api-for-apache-cassandra-4.0,...
MAL-2026-5347 Malicious code in moustick (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector deae034e46d94eafe1db97a6a57a664400f03caa48af8f775f6064c361c6bb9a Package impersonates the popular cookie-signature library — it copies the description, README, author TJ Holowaychuk, and repository URL of...
Malicious code in moustick (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector deae034e46d94eafe1db97a6a57a664400f03caa48af8f775f6064c361c6bb9a Package impersonates the popular cookie-signature library — it copies the description, README, author TJ Holowaychuk, and repository URL of...
openshell-sandbox-poc
OpenShell + Kata Containers: Dual-Protection PoC A proof-of-c...
GHSA-F6VJ-48FM-HMVX Apache Airflow has a Path Traversal issue
The Apache Airflow Samba provider's GCSToSambaOperator joined GCS object names to the SMB destination path without a containment check, so an object named with ../ segments resolved a write path outside the configured destinationpath. An attacker able to write objects into the source GCS bucket —...
Apache Airflow has a Path Traversal issue
The Apache Airflow Samba provider's GCSToSambaOperator joined GCS object names to the SMB destination path without a containment check, so an object named with ../ segments resolved a write path outside the configured destinationpath. An attacker able to write objects into the source GCS bucket —...
Malicious code in @bancolonbia/menu-filter-widget-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76511e7873dc4a76b8447f91807e48289877ee612cd0d94526206390bbda7f3e package.json declares scripts.postinstall: node./callback.js, which fires automatically on npm install. callback.js reads the installer's hostname an...
MAL-2026-5344 Malicious code in @bancolonbia/menu-filter-widget-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76511e7873dc4a76b8447f91807e48289877ee612cd0d94526206390bbda7f3e package.json declares scripts.postinstall: node./callback.js, which fires automatically on npm install. callback.js reads the installer's hostname an...
PYSEC-2026-208
The Apache Airflow Samba provider's GCSToSambaOperator joined GCS object names to the SMB destination path without a containment check, so an object named with ../ segments resolved a write path outside the configured destinationpath. An attacker able to write objects into the source GCS bucket —...
CVE-2026-49818
The Apache Airflow Samba provider's GCSToSambaOperator joined GCS object names to the SMB destination path without a containment check, so an object named with ../ segments resolved a write path outside the configured destinationpath. An attacker able to write objects into the source GCS bucket —...
PYSEC-2026-208
The Apache Airflow Samba provider's GCSToSambaOperator joined GCS object names to the SMB destination path without a containment check, so an object named with ../ segments resolved a write path outside the configured destinationpath. An attacker able to write objects into the source GCS bucket —...
Malicious code in @demica/shared (npm)
Note: This report is updated by a verification record Dep-confusion squat of internal @demica/shared at sentinel high version 99.99.100 + auto-exec postinstall canary.js beaconing to RAW IP 157.230.17.236:80/dc. Sentinel-high-version + auto-exec beacon = MALICIOUS per operator policy c913;...
MAL-2026-5351 Malicious code in @demica/shared (npm)
Note: This report is updated by a verification record Dep-confusion squat of internal @demica/shared at sentinel high version 99.99.100 + auto-exec postinstall canary.js beaconing to RAW IP 157.230.17.236:80/dc. Sentinel-high-version + auto-exec beacon = MALICIOUS per operator policy c913;...
Malicious code in @demica/resources (npm)
Note: This report is updated by a verification record Dep-confusion squat of internal @demica/resources at sentinel high version 99.99.100 + auto-exec postinstall canary.js beaconing to RAW IP 157.230.17.236:80/dc. Sentinel-high-version + auto-exec beacon = MALICIOUS per operator policy c913;...
MAL-2026-5350 Malicious code in @demica/resources (npm)
Note: This report is updated by a verification record Dep-confusion squat of internal @demica/resources at sentinel high version 99.99.100 + auto-exec postinstall canary.js beaconing to RAW IP 157.230.17.236:80/dc. Sentinel-high-version + auto-exec beacon = MALICIOUS per operator policy c913;...
Malicious code in @demica/core (npm)
Dep-confusion squat of internal @demica/core at sentinel high version 99.99.100 + auto-exec postinstall canary.js beaconing to RAW IP 157.230.17.236:80/dc. Sentinel-high-version + auto-exec beacon = MALICIOUS per operator policy c913; "authorized benign canary" framing does NOT downgrade, raw-IP...
MAL-2026-5349 Malicious code in @demica/core (npm)
Dep-confusion squat of internal @demica/core at sentinel high version 99.99.100 + auto-exec postinstall canary.js beaconing to RAW IP 157.230.17.236:80/dc. Sentinel-high-version + auto-exec beacon = MALICIOUS per operator policy c913; "authorized benign canary" framing does NOT downgrade, raw-IP...
GHSA-X4GW-5CX5-PGMH vulnerabilities
Vulnerabilities for packages: solr, akhq, spark, infinispan, neo4j, apache-nifi-registry, opensearch, strimzi-kafka-operator, zookeeper, apicurio-registry, logstash, celeborn, docker-selenium, druid, wavefront-proxy, trino, cassandra, apache-nifi, kserve-modelmesh, zipkin, keycloak, flyway,...
CVE-2026-45416 vulnerabilities
Vulnerabilities for packages: solr, akhq, spark, infinispan, neo4j, apache-nifi-registry, opensearch, strimzi-kafka-operator, zookeeper, apicurio-registry, logstash, celeborn, docker-selenium, druid, wavefront-proxy, trino, cassandra, apache-nifi, kserve-modelmesh, zipkin, keycloak, flyway,...