1158013 matches found
MAL-2026-5351 Malicious code in @demica/shared (npm)
Note: This report is updated by a verification record Dep-confusion squat of internal @demica/shared at sentinel high version 99.99.100 + auto-exec postinstall canary.js beaconing to RAW IP 157.230.17.236:80/dc. Sentinel-high-version + auto-exec beacon = MALICIOUS per operator policy c913;...
Malicious code in @demica/resources (npm)
Note: This report is updated by a verification record Dep-confusion squat of internal @demica/resources at sentinel high version 99.99.100 + auto-exec postinstall canary.js beaconing to RAW IP 157.230.17.236:80/dc. Sentinel-high-version + auto-exec beacon = MALICIOUS per operator policy c913;...
MAL-2026-5350 Malicious code in @demica/resources (npm)
Note: This report is updated by a verification record Dep-confusion squat of internal @demica/resources at sentinel high version 99.99.100 + auto-exec postinstall canary.js beaconing to RAW IP 157.230.17.236:80/dc. Sentinel-high-version + auto-exec beacon = MALICIOUS per operator policy c913;...
Malicious code in @demica/core (npm)
Dep-confusion squat of internal @demica/core at sentinel high version 99.99.100 + auto-exec postinstall canary.js beaconing to RAW IP 157.230.17.236:80/dc. Sentinel-high-version + auto-exec beacon = MALICIOUS per operator policy c913; "authorized benign canary" framing does NOT downgrade, raw-IP...
MAL-2026-5349 Malicious code in @demica/core (npm)
Dep-confusion squat of internal @demica/core at sentinel high version 99.99.100 + auto-exec postinstall canary.js beaconing to RAW IP 157.230.17.236:80/dc. Sentinel-high-version + auto-exec beacon = MALICIOUS per operator policy c913; "authorized benign canary" framing does NOT downgrade, raw-IP...
CVE-2026-45416 vulnerabilities
Vulnerabilities for packages: flyway, sonarqube, keycloak, apache-activemq-artemis, apache-pulsar, spark, neo4j, apache-nifi, trino, solr, infinispan, tez, wavefront-proxy, zipkin, cassandra, wildfly, opensearch, strimzi-kafka-operator, thingsboard, kserve-modelmesh, logstash, celeborn,...
GHSA-X4GW-5CX5-PGMH vulnerabilities
Vulnerabilities for packages: flyway, sonarqube, keycloak, apache-activemq-artemis, apache-pulsar, spark, neo4j, apache-nifi, trino, solr, infinispan, tez, wavefront-proxy, zipkin, cassandra, wildfly, opensearch, strimzi-kafka-operator, thingsboard, kserve-modelmesh, logstash, celeborn,...
CVE-2026-44249 vulnerabilities
Vulnerabilities for packages: flyway, sonarqube, keycloak, apache-activemq-artemis, apache-pulsar, spark, neo4j, apache-nifi, trino, solr, infinispan, tez, wavefront-proxy, zipkin, cassandra, wildfly, opensearch, strimzi-kafka-operator, thingsboard, kserve-modelmesh, logstash, celeborn,...
GHSA-3QP7-7MW8-WX86 vulnerabilities
Vulnerabilities for packages: flyway, sonarqube, keycloak, apache-activemq-artemis, apache-pulsar, spark, neo4j, apache-nifi, trino, solr, infinispan, tez, wavefront-proxy, zipkin, cassandra, wildfly, opensearch, strimzi-kafka-operator, thingsboard, kserve-modelmesh, logstash, celeborn,...
CVE-2026-49818 Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object names
The Apache Airflow Samba provider's GCSToSambaOperator joined GCS object names to the SMB destination path without a containment check, so an object named with ../ segments resolved a write path outside the configured destinationpath. An attacker able to write objects into the source GCS bucket —...
CVE-2026-49818
The CVE concerns Apache Airflow Samba provider’s GCSToSambaOperator, which concatenates GCS object names to the SMB destination path without proper containment checks. This allows objects with ../ segments to traverse outside destination_path, enabling an unauthenticated-like attacker able to wri...
CVE-2026-49818 Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object names
The Apache Airflow Samba provider's GCSToSambaOperator joined GCS object names to the SMB destination path without a containment check, so an object named with ../ segments resolved a write path outside the configured destinationpath. An attacker able to write objects into the source GCS bucket —...
CVE-2026-49818 Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object names
The Apache Airflow Samba provider's GCSToSambaOperator joined GCS object names to the SMB destination path without a containment check, so an object named with ../ segments resolved a write path outside the configured destinationpath. An attacker able to write objects into the source GCS bucket —...
EUVD-2026-35374
The Apache Airflow Samba provider's GCSToSambaOperator joined GCS object names to the SMB destination path without a containment check, so an object named with ../ segments resolved a write path outside the configured destinationpath. An attacker able to write objects into the source GCS bucket —...
CVE-2026-45416 vulnerabilities
Vulnerabilities for packages: s3proxy, elasticsearch-fips, grpc-java-fips, docker-selenium, opensearch-fips, commercial-elasticsearch, management-api-for-apache-cassandra-5.0, kafbat-ui, spark, hadoop-fips, seata, selenium, kafbat-ui-fips, cassandra-reaper, hono, camunda-zeebe, reposilite,...
CVE-2026-44249 vulnerabilities
Vulnerabilities for packages: s3proxy, elasticsearch-fips, grpc-java-fips, docker-selenium, opensearch-fips, commercial-elasticsearch, management-api-for-apache-cassandra-5.0, kafbat-ui, spark, hadoop-fips, seata, selenium, kafbat-ui-fips, cassandra-reaper, hono, camunda-zeebe, reposilite,...
GHSA-X4GW-5CX5-PGMH vulnerabilities
Vulnerabilities for packages: s3proxy, elasticsearch-fips, grpc-java-fips, docker-selenium, opensearch-fips, commercial-elasticsearch, management-api-for-apache-cassandra-5.0, kafbat-ui, spark, hadoop-fips, seata, selenium, kafbat-ui-fips, cassandra-reaper, hono, camunda-zeebe, reposilite,...
GHSA-3QP7-7MW8-WX86 vulnerabilities
Vulnerabilities for packages: s3proxy, elasticsearch-fips, grpc-java-fips, docker-selenium, opensearch-fips, commercial-elasticsearch, management-api-for-apache-cassandra-5.0, kafbat-ui, spark, hadoop-fips, seata, selenium, kafbat-ui-fips, cassandra-reaper, hono, camunda-zeebe, reposilite,...
CVE-2026-8499
The Helpfulcrowd Product Reviews plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in versions up to, and including, 1.2.9. This is due to the helpfulcrowdvalidatetoken function using a loose comparison operator != instead of a strict comparison !== when validating...
