Malicious code in @ifasn/ms-doc-mcp (npm)

Source: amazon-inspector 89e10b57cd0911868969f2eaaa148e203d93745c5873d17c19e92ecec24d903d Package advertises itself as a Markdown toolkit MCP server TOC generation, word count, table formatting but its main/bin entry unconditionally invokes an imdsAudit routine at module load that probes the...

CVE-2026-3333-DNS-Rebinding-to-Steal-Cloud-Metadata

CVE-2026-3333 – DNS Rebinding to Steal Cloud Metadata Program Code Python attacker server + vulnerable app !/usr/bin/env python3 dnsrebindingserver.py - Malicious DNS server that alternates between attacker IP and 169.254.169.254 import socket, threading, time This simple server resolves any...

CVE-2026-64849

CVE-2026-64849 More POST /api/2.0/mlflow/webhooks HTTP/1.1 Host: Content-Type: application/json "url": "https://httpbin.org/redirect-to?url=http://169.254.169.254/latest/meta-data/", "name": "poc", "events": "action": "CREATED", "entity": "REGISTEREDMODEL" POST /api/2.0/mlflow/webhooks/id/test...

CVE-2026-13303

HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue...

CVE-2026-13303 Boundary vulnerable to server-side request forgery in Vault credential store

HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue...

CVE-2026-13303

HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery (SSRF) within the Vault credential store integration . An authenticated user with permissions to manage credential stores and libraries can force the Boundary controller to issue outbound requests to a chos...

CVE-2026-13303 Boundary vulnerable to server-side request forgery in Vault credential store

HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue...

CVE-2026-13303

HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue...

EUVD-2026-113390

HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue...

Malicious code in spectral-core (npm)

Source: amazon-inspector 451c36f03e81be0ff6c85334587d7ff401de1e5134e179557ec4bc454cd7ba76 The tarball ships only package.json and binding.gyp plus a markdown file, with gypfile: true set in package.json so npm invokes node-gyp rebuild on install. binding.gyp declares a 'none'-type target with no...

MAL-2026-18377 Malicious code in spectral-core (npm)

spectral-core contains no library code: where an index.js is present e.g. 3.0.12 it only exports the package name and version. It ships a binding.gyp and package.json sets "gypfile": true, so npm runs node-gyp rebuild on install, and the binding.gyp declares a build action "Finalizing spectral-co...

Malicious code in spectral-core (npm)

spectral-core contains no library code: where an index.js is present e.g. 3.0.12 it only exports the package name and version. It ships a binding.gyp and package.json sets "gypfile": true, so npm runs node-gyp rebuild on install, and the binding.gyp declares a build action "Finalizing spectral-co...

PT-2026-132843

HashiCorp Boundary and Boundary Enterprise are vulnerable to a server-side request forgery in the Vault credential store integration that may allow an authenticated user with permission to manage credential stores and credential libraries within a project to cause the Boundary controller to issue...

CVE-2026-110868

Renovate versions before 44.79.0 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. The issue allows users to force the shared HTTP client to request arbitrary internal URLs through extends presets or customDatasources . An attacker can exploit this by pointing a preset at an i...

CVE-2026-110868 Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasources

Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials o...

metabadger

Metabadger Previene ataques SSRF en AWS EC2 mediante actualizaciones automatizadas al más seguro Servicio de Metadatos de Instancia v2 IMDSv2. Metabadger Propósito y funcionalidad Diagnosticar y evaluar tu uso actual del Servicio de Metadatos de Instancia de AWS, además de entender cómo funciona ...

PT-2026-105840

Summary make ssrf safe hook blocks HTTP redirects to private/internal IPs by validating the Location header before the client follows a 3xx response. The problem is that this hook is only attached in one of three authentication branches — the header-PAT path. Basic auth and OAuth branches skip it...

CVE-2026-55177

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2026-55177 CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guard

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...

CVE-2026-55177

CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every route in the ESRI helper family api/routes/esri.ts takes a fully attacker-controlled URL from the request POST /api/esri body url, and the portal / server / lay...