GO-2026-4488 vulnerabilities

Vulnerabilities for packages: ipfs-cluster, k3s, kubo, spegel...

GO-2026-4479 vulnerabilities

Vulnerabilities for packages: op-geth, kubo, spegel, ipfs-cluster, k3s...

GO-2026-5684 vulnerabilities

Vulnerabilities for packages: ipfs-cluster, k3s, spegel...

GO-2026-4485 vulnerabilities

Vulnerabilities for packages: ipfs-cluster, k3s, kubo, spegel...

GO-2026-5676 vulnerabilities

Vulnerabilities for packages: frp, dkron, jitsucom-bulker, kyverno-policy-reporter, kubo, traefik, spegel, ipfs-cluster, k8sgateway, kargo, opentelemetry-operator, kube-metrics-adapter, teleport, k3s, kyverno-policy-reporter-ui, q, kubernetes-dns-node-cache, coredns...

GO-2025-4017 vulnerabilities

Vulnerabilities for packages: frp, dkron, caddy, kubo, spegel, traefik, ipfs-cluster, k8sgateway, kargo, k3s, kyverno-policy-reporter-ui, q, kubernetes-dns-node-cache...

GO-2025-4233 vulnerabilities

Vulnerabilities for packages: frp, buf, dkron, seaweedfs, caddy, kubo, spegel, traefik, ipfs-cluster, k8sgateway, kargo, k3s, q, kubernetes-dns-node-cache...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: containerd, glow, timescaledb-tune, libnvidia-container, polaris, nri-haproxy, dgraph, argo-events, docker-machine-driver-harvester, cluster-api-azure-controller, nri-f5, kubernetes-dashboard, nri-redis, emissary, lazydocker, clickhouse-operator, wgcf, ko,...

CVE-2026-54908 vulnerabilities

Vulnerabilities for packages: telegraf, kubo, spegel, ipfs-cluster, k3s...

GHSA-34RH-WP3J-6CXC vulnerabilities

Vulnerabilities for packages: op-geth, kubo, spegel, ipfs-cluster, k3s...

GHSA-WG4G-WM44-CH5J vulnerabilities

Vulnerabilities for packages: telegraf, kubo, spegel, ipfs-cluster, k3s...

CVE-2026-54909 vulnerabilities

Vulnerabilities for packages: op-geth, kubo, spegel, ipfs-cluster, k3s...

ipfs:ipfs_ds_pebble: Crash in ipfs_ds_pebble

Detailed Report: https://oss-fuzz.com/testcase?key=5988544022904832 Project: ipfs Fuzzing Engine: libFuzzer Fuzz Target: ipfsdspebble Job Type: libfuzzerasanipfs Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0xfffffffffffffff0 Crash State: ipfsdspebble Sanitizer: address ASAN...

Malicious code in eth-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f051957ac6f91e8567df873978b45c0c81a170f94decbd735d329f312ff1bb On require, index.js schedules a 37-second delayed routine that reads test/fixtures/keypairs.dat, base64-decodes it into /.cache-db/.node-sync/syncd....

MAL-2026-10211 Malicious code in react-next-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 286869faf09aec1d62b472e43a7188a1583c5cf8c999d1fb2e116f0b7f5ba8c6 The package impersonates the pino logger README/badges reference pino; module.exports.pino is the middleware while its name is react-next-vite. When ...

Malicious code in jupiter-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8e0901ca45da110106c60f288b0166fc51c348a44569d7e7ff22af3d19deafe On import jupitersdk, the package's top-level init.py fetches a payload over HTTPS from a public IPFS gateway...

Malicious code in eth-agent (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3131490d64c4ae90de2926ca90f6fce23e6a113d1e6538db5ce98ffcf06983d1 The top-level ethagent/init.py performs an outbound HTTP fetch to a hardcoded IPFS gateway URL...

Malicious code in solidity-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30501f6602a5b5b436ef5d6224ec332fa866c9e8b9da4d0de3bc69de868b1fff soliditydev/init.py contains a large base64-encoded Linux x8664 ELF binary in PAYLOADB64. On import soliditydev, the module decodes the blob, writes ...

MAL-2026-10155 Malicious code in notify-funcs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b65341bde476af6b80e1fbaa9f9a844b7fdc023ef02f5fabb88514d88012159 The package presents itself as a pino-compatible logging middleware exports check as both default and pino named export but its actual behavior on...

MAL-2026-10077 Malicious code in type-slint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b5cd26e040f4f4366ed65cca4b70258d276f781e0aab76b99b5573d4007a97d The npm package [email protected] masquerades as the pino logger copied module layout, exports as module.exports.pino, keywords fast/logger/stream/jso...