256648 matches found
Malicious code in @emerald-react/avatar (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3683097454908b17afa3726cc9519d1e62c51f5b8932235470cbf0efcfb27099 The package @emerald-react/avatar was found to contain malicious code...
MAL-2026-1598 Malicious code in @emerald-react/avatar (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3683097454908b17afa3726cc9519d1e62c51f5b8932235470cbf0efcfb27099 The package @emerald-react/avatar was found to contain malicious code...
Malicious code in @commonschema/blackstone-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6f3edc28bea0e512a6dcee373cec98f067d76a64791869cfe843a2434edca05 The package @commonschema/blackstone-core was found to contain malicious code...
MAL-2026-1595 Malicious code in @commonschema/blackstone-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6f3edc28bea0e512a6dcee373cec98f067d76a64791869cfe843a2434edca05 The package @commonschema/blackstone-core was found to contain malicious code...
MAL-2026-1593 Malicious code in @cbreone/utilities (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31471b3974ae749750afb01ba4ff12659b1fd6494074e836252926e064df6a32 The package @cbreone/utilities was found to contain malicious code...
MAL-2026-1592 Malicious code in @cbreone/survey-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa512020ca8dd602c54abcdc6b69379bc5656423a35dabd5200db0e3b8af7fd6 The package @cbreone/survey-ui was found to contain malicious code...
Malicious code in @cbreone/core-services (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ae6ae37b27a798985e4dcf5adf27c7fe173717d253c4fab67acf96656bb9f8b The package @cbreone/core-services was found to contain malicious code...
MAL-2026-1588 Malicious code in @bingads-webui-help/apex.core.v3.min (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87351101634ee5726eaa0ee76ecaec8529226c993a610ea5a2d1b7521778bd5a The package @bingads-webui-help/apex.core.v3.min was found to contain malicious code...
Malicious code in @at-point/valiant-widgets-v2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87532b33037ce0d72b75f2ca654c5b66bf97048b3d1226ca6bdb396af6670c4a The package @at-point/valiant-widgets-v2 was found to contain malicious code...
MAL-2026-1585 Malicious code in @anchor-ds/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9aaac3fbc20e4d10a4fcf379fa4637f05e1dccd9fb6123bdd9b0e26ce5e21854 The package @anchor-ds/core was found to contain malicious code...
Malicious code in @anchor-ds/core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9aaac3fbc20e4d10a4fcf379fa4637f05e1dccd9fb6123bdd9b0e26ce5e21854 The package @anchor-ds/core was found to contain malicious code...
Arbitrary File Read
github.com/kedacore/keda is vulnerable to Arbitrary File Read. The vulnerability is due to insufficient path validation when loading the Service Account Token from spec.hashiCorpVault.credential.serviceAccount, which allows an attacker with permission to create or modify a TriggerAuthentication...
MAL-2026-1542 Malicious code in bugbounty-test-123 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c22630300fe50578818f50f4a068d400f9e434dc0341fff5a6cd0ca63e82d5e1 The package bugbounty-test-123 was found to contain malicious code. Source: ossf-package-analysis...
CVE-2026-22179
OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows remote attackers to execute non-allowlisted commands by exploiting improper parsing of command substitution tokens. Attackers can craft shell payloads with command substitution...
CVE-2026-22177
OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inject variables like NODEOPTIONS or LD through configuration to execute arbitrary code in the OpenClaw gateway service...
EUVD-2026-12724
OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows remote attackers to execute non-allowlisted commands by exploiting improper parsing of command substitution tokens. Attackers can craft shell payloads with command substitution...
CVE-2026-22179 OpenClaw < 2026.2.22 - Allowlist Bypass via Command Substitution in system.run
OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows remote attackers to execute non-allowlisted commands by exploiting improper parsing of command substitution tokens. Attackers can craft shell payloads with command substitution...
CVE-2026-22179
OpenClaw versions prior to 2026.2.22 in macOS node-host system.run contain an allowlist bypass vulnerability that allows remote attackers to execute non-allowlisted commands by exploiting improper parsing of command substitution tokens. Attackers can craft shell payloads with command substitution...
CVE-2026-22177 OpenClaw < 2026.2.21 - Environment Variable Injection via Config env.vars
OpenClaw versions prior to 2026.2.21 fail to filter dangerous process-control environment variables from config env.vars, allowing startup-time code execution. Attackers can inject variables like NODEOPTIONS or LD through configuration to execute arbitrary code in the OpenClaw gateway service...
CVE-2026-22168 OpenClaw < 2026.2.21 - Command Injection via cmd.exe /c Trailing Arguments in system.run
OpenClaw versions prior to 2026.2.21 contain an approval-integrity mismatch vulnerability in system.run that allows authenticated operators to execute arbitrary trailing arguments after cmd.exe /c while approval text reflects only a benign command. Attackers can smuggle malicious arguments throug...