Lucene search
+L

255676 matches found

Cvelist
Cvelist
added 2026/07/17 12:7 a.m.54 views

CVE-2026-62228 OpenClaw < 2026.6.5 Authorization Bypass via Node Exec Approvals

OpenClaw before 2026.6.5 contain an authorization bypass vulnerability in node exec approvals that allows lower-trust callers to execute actions beyond their intended authorization by using different gateway and node environments. Attackers can exploit mismatched environment configurations to...

8.8CVSS0.00248EPSS
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 10:28 p.m.23 views

Malicious code in my-tailwind-gutenberg-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ba41c0d8f447e47febb6ceed2c87681bb0f518b74d42d898e024a7ab4418f61 The package advertises itself as a WordPress Gutenberg + Tailwind block scaffold src/edit.js, src/save.js, block.json, but the tarball also contains...

5.7AI score
SaveExploits0References6
OSV
OSV
added 2026/07/16 10:17 p.m.12 views

UBUNTU-CVE-2026-57075

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syckbase64dec. The base64 decoder in the bundled libsyck indexes the 256-entry static table b64xtable with a signed char, so any !!binary byte = 0x80 sign-extends to a negative index and...

9.1CVSS5.3AI score0.00374EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/16 9:39 p.m.42 views

CVE-2026-57075 YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec

YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syckbase64dec. The base64 decoder in the bundled libsyck indexes the 256-entry static table b64xtable with a signed char, so any !!binary byte = 0x80 sign-extends to a negative index and...

0.00374EPSS
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 6:46 p.m.40 views

Malicious code in patchwork-os (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc351c90dbe7a3ede9536138db9071a7cc8b2f8b2824b7956f26553e349a72d9 dist/drivers/gemini/index.js line 53 contains a literal curl https://attacker string co-located with an install reference line 286, matching a...

5.7AI score
SaveExploits0References7
OSV
OSV
added 2026/07/16 6:46 p.m.8 views

MAL-2026-10721 Malicious code in @whalent/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13a01c1162adb93d3960d9e1b1b67095dcf0a1ea72aefa6d471d0abbbabb5d9a The package installs a whalent CLI daemon that opens a persistent WebSocket connection wss:// to a Whalent Memory gateway and, per its own README,...

5.9AI score
SaveExploits0References41
OSV
OSV
added 2026/07/16 6:45 p.m.10 views

MAL-2026-10730 Malicious code in codeam-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2e8b39baa6129e1e1988002fcbeb2f62464f84fc7458f82f3754d1033a9b4ca6 codeam-cli spawns a node-pty pseudo-terminal wrapping the local Claude Code / Codex agent process and connects outbound over WebSocket to a hardcoded...

6.6AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 6:41 p.m.28 views

Malicious code in @agent-link/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7018626958a160ab35a17b31ddd130ba9b6046b870f115b0fa83622b66bd912 The package's runtime connects to a hardcoded WebSocket relay default wss://msclaude.ai and dispatches messages received from that relay directly int...

5.8AI score
SaveExploits0References41
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 6:41 p.m.24 views

Malicious code in @whalent/agent-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8865ae7d25a498766280337f12ceea445a92bd6a6565e668651a79dbcc152e9 The package's main/bin entry dist/index.cjs implements a remote agent that opens a WebSocket to a gateway configured via WHALENTGATEWAY / WHALENTTOKE...

6.2AI score
SaveExploits0References49
OSV
OSV
added 2026/07/16 6:37 p.m.8 views

MAL-2026-10731 Malicious code in date-utils-light (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99bd644fd9a59518d6f77e8d76c077ffef8a2afdc7ae2b00a6ca87299879a671 Package presents itself as a trivial date-formatting utility index.js exports a one-line ISO date helper but ships a postinstall.js that runs...

6.2AI score
SaveExploits0References1
OSV
OSV
added 2026/07/16 6:33 p.m.9 views

MAL-2026-10711 Malicious code in @funny-booth/agent-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6693129f8b6f8b6c2d52722ca7746d6ef3dd792476297fa3583d3956548eb2b4 The package ships heavily obfuscated runtime files dist/index.js, dist/launcher.js built with javascript-obfuscator. The MCP server registered as the...

6.3AI score
SaveExploits0References6
NVD
NVD
added 2026/07/16 6:16 p.m.12 views

CVE-2026-44970

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emittoolcalledevent in src/dbtmcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent it through dbtlabsvortex.producer.logproto without redaction,...

4.3CVSS0.00236EPSS
SaveExploits1References4
Cvelist
Cvelist
added 2026/07/16 5:48 p.m.45 views

CVE-2026-44968 dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, rundbtcommand in src/dbtmcp/dbtcli/tools.py appended unsanitized nodeselection and resourcetype values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-di...

6.3CVSS0.00172EPSS
SaveExploits1References4
CVE
CVE
added 2026/07/16 5:48 p.m.54 views

CVE-2026-44968

Summary: CVE-2026-44968 affects dbt-mcp (Model Context Protocol server). Prior to v1.17.1, _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appended user-supplied MCP parameters to the dbt subprocess argv without validation. This enables argument-list injection via two vectors: (1) node_selecti...

6.3CVSS6.1AI score0.00172EPSS
SaveExploits1References4Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/07/16 5:48 p.m.12 views

CVE-2026-44968

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, rundbtcommand in src/dbtmcp/dbtcli/tools.py appended unsanitized nodeselection and resourcetype values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-di...

6.3CVSS6.1AI score0.00172EPSS
SaveExploits1References5Affected Software1
OSV
OSV
added 2026/07/16 5:48 p.m.11 views

CVE-2026-44968 dbt-mcp: Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, rundbtcommand in src/dbtmcp/dbtcli/tools.py appended unsanitized nodeselection and resourcetype values to the dbt subprocess argument list, allowing an MCP client to inject dbt global flags such as --profiles-di...

6.3CVSS6.1AI score
SaveExploits0References6
OSV
OSV
added 2026/07/16 2:26 p.m.8 views

MAL-2026-10700 Malicious code in time-format-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 168d334d742003cf94d8b87ba56cd72694081ade01f6814062e58ebdc47d8594 On npm install, the package's postinstall script decodes base64-encoded shell payloads and executes them via an obfuscated childprocess.exec lookup...

6.1AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 2:26 p.m.28 views

Malicious code in time-format-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 168d334d742003cf94d8b87ba56cd72694081ade01f6814062e58ebdc47d8594 On npm install, the package's postinstall script decodes base64-encoded shell payloads and executes them via an obfuscated childprocess.exec lookup...

6.1AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 8:13 a.m.24 views

Malicious code in ai-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8addfcd7b527a107164a782a0a85fad3e318dcbe195643df859a15f159977baa The package ships a single index.html that embeds a hardcoded Google Generative Language API key as a JavaScript constant const GEMINIKEY =...

5.7AI score
SaveExploits0References6
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 8:13 a.m.22 views

Malicious code in websight-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a70a4fdffa4457cd6366270226f065017c57aeac78fdbb062237ebf39284af78 The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ with header x-access: p2p and passes the response to...

5.9AI score
SaveExploits0References8
Rows per page
Query Builder