CVE-2026-86539

knowns through version 0.33.0 contains a server-side request forgery (SSRF) vulnerability in the POST /api/embedding-models/test endpoint. The endpoint issues outbound requests to caller-supplied destinations without validating the target, allowing unauthenticated attackers to enumerate internal ...

CVE-2026-86538

Knowns versions prior to 0.30.0 are affected by a path traversal vulnerability in the POST /api/templates/preview endpoint. An unauthenticated attacker can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read arbitrary files—such as credentials a...

Malicious code in @malware-test-magma-lunes-knows-kudos/test-mlw3-magma-lunes-knows-kudos (npm)

The package @malware-test-magma-lunes-knows-kudos/test-mlw3-magma-lunes-knows-kudos was found to contain malicious code...

MAL-2025-8777 Malicious code in @malware-test-magma-lunes-knows-kudos/test-mlw3-magma-lunes-knows-kudos (npm)

The package @malware-test-magma-lunes-knows-kudos/test-mlw3-magma-lunes-knows-kudos was found to contain malicious code...