CVE-2026-86538

knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint. An unauthenticated attacker can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read arbitrary files, such as credentials and config...

CVE-2026-86539 knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...

CVE-2026-86539

knowns through version 0.33.0 contains a server-side request forgery (SSRF) vulnerability in the POST /api/embedding-models/test endpoint. The endpoint issues outbound requests to caller-supplied destinations without validating the target, allowing unauthenticated attackers to enumerate internal ...

Malicious code in @malware-test-magma-lunes-knows-kudos/test-mlw3-magma-lunes-knows-kudos (npm)

The package @malware-test-magma-lunes-knows-kudos/test-mlw3-magma-lunes-knows-kudos was found to contain malicious code...

MAL-2025-8777 Malicious code in @malware-test-magma-lunes-knows-kudos/test-mlw3-magma-lunes-knows-kudos (npm)

The package @malware-test-magma-lunes-knows-kudos/test-mlw3-magma-lunes-knows-kudos was found to contain malicious code...