Malicious code in hit-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a87a289453b876b0dae6773dc57ed8fff3f935d293bf9256287af064d6f2bfa3 lib/report.js imports childprocess, fs, https, and os, reads local files via fs.readFileSync, gathers host identity via os.hostname and os.userInfo,...

MAL-2026-11455 Malicious code in allurectl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 186241f7063cd1f10fe15814d834b890f99c1a3360f2f6a4e6190169ff0481eb Package name impersonates Qameta's Allure TestOps CLI allurectl but ships unrelated code that harvests developer identity and posts it to a hardcoded...

Malicious code in allurectl (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 186241f7063cd1f10fe15814d834b890f99c1a3360f2f6a4e6190169ff0481eb Package name impersonates Qameta's Allure TestOps CLI allurectl but ships unrelated code that harvests developer identity and posts it to a hardcoded...

MAL-2026-11472 Malicious code in mcp-server-boilerplate (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50ee88b53e786db18609f7956c556a7f814b476c895bb90d5663aedc82ca14f0 Package name 'mcp-server-boilerplate' is unrelated to the Model Context Protocol ecosystem it evokes; the shipped code is a data-collection payload...

Malicious code in iwomm-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc6a86a4bd25e85d55ccc7babe614b8cf8eb1b31572b67b1f463ad0302263669 lib/report.js imports childprocess, fs, https and os, collects host and user identity data via os.hostname and os.userInfo lib/report.js lines 160-16...

Malicious code in community-published (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90e9bda1a7ca0f5b1083fe65572c94f131306fd5323f731cf79422d51c567f8a lib/report.js imports childprocess, fs, https, and os, invokes execSync and fs.readFileSync to collect host and file data, gathers identifiers via...

MAL-2026-11458 Malicious code in chaos-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a21d36cc80c620f92695d98b05bcfc786a623e64b18b1394f2c85064fc44fb53 lib/report.js imports childprocess, fs, os, and https and, via execSync plus fs.readFileSync calls, collects host identifiers os.hostname, os.userInf...

Malicious code in gtm-mcp-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07518fbe4f5f7d6807b80e7155b10a7f419e931302e6ee6c64b3200d6b4a6db1 lib/report.js imports childprocess, fs, https, and os and posts collected host information to a hardcoded https://hooks.zapier.com endpoint. The modu...

EUVD-2026-36589

@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag...

@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag

Summary The @apostrophecms/seo package injects the Google Analytics Tracking ID seoGoogleTrackingId and Google Tag Manager ID seoGoogleTagManager directly into tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access the default role...

Malicious code in install-native-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 757eb666248556142f82ce2793cd42e7e30db4ce65efc823eaed2a71c14087f2 lib/report.js collects host and user identifying data via os.hostname, os.userInfo, execSync-invoked system commands, and fs.readFileSync of local...

MAL-2026-11454 Malicious code in ai-backup-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5603e10be681ac5a86236edb1ce9cf53615e02867d7ff230a392b8363d7220b The package is named 'ai-backup-script' but performs no backup functionality. lib/report.js collects the installer's git/GitHub email via gh api, git...

NPM: re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

NPM: re2: Global String.prototype.match with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth DoS vulnerability discovered by ? in WordPress Npm re2 versions = 1.25.1...

ROOT-APP-NPM-CVE-2026-59877 CVE-2026-59877 in @rootio/protobufjs - Patched by Root

Root has patched CVE-2026-59877 in the @rootio/protobufjs package for Root:npm. Multiple fixed versions available...

RHSA-2026:48758 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

CVE-2026-18218

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application client using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older,...

CVE-2026-15258

The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks...

EUVD-2026-51478

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application client using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older,...

HPE Edgeline Infrastructure Manager <1.22 - Authentication Bypass

HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software, prior to version 1.22 contains an authentication bypass vulnerability which could be remotely exploited to bypass remote authentication and possibly lead to execution of arbitrary commands, gaining...

IBM Data Risk Manager - Authentication Bypass via SAML

IBM Data Risk Manager versions 2.0.1 through 2.0.6 are vulnerable to authentication bypass when configured with SAML authentication. A remote attacker can bypass security restrictions by sending a specially crafted HTTP request to the SAML idpSelection endpoint, allowing them to bypass the...