7533 matches found
EUVD-2026-53695
A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function getfilecontent of the file server.py of the component executetoolmanually Endpoint. The manipulation of the argument toolname/toolparams results in information disclosure. The attack can be launched...
CVE-2026-18974
A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function getfilecontent of the file server.py of the component executetoolmanually Endpoint. The manipulation of the argument toolname/toolparams results in information disclosure. The attack can be launched...
EUVD-2026-53694
A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitizeproxyurl of the file server.py of the component extensionproxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated...
CVE-2026-18973
The CVE-2026-18973 entry concerns heshengtao super-agent-party (
CVE-2026-18973
A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitizeproxyurl of the file server.py of the component extensionproxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated...
CVE-2026-18973 heshengtao super-agent-party extension_proxy Route server.py sanitize_proxy_url server-side request forgery
A vulnerability has been found in heshengtao super-agent-party up to 0.4.1. The impacted element is the function sanitizeproxyurl of the file server.py of the component extensionproxy Route. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated...
MAL-2026-13369 Malicious code in kepler (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 672a1c042704318fe56d5da08c0f1d20b404274bd6ad339efc2f1c581d869d77 [email protected] declares its only runtime dependency, flag-serial-object-syntax, as an HTTP URL to a third-party host...
Malicious code in kepler (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 672a1c042704318fe56d5da08c0f1d20b404274bd6ad339efc2f1c581d869d77 [email protected] declares its only runtime dependency, flag-serial-object-syntax, as an HTTP URL to a third-party host...
MAL-2026-13355 Malicious code in @astralcore/sl-aura (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91ae2c72e5e03d23f3f5704859e8c92b9ce6c565c6d14d744d4382b980a0d233 This WhatsApp bot package ships several mechanisms that give the author persistent remote control of any installer's running instance and access to t...
Malicious code in anthropic-setup (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector baee404f50ce2f767660b7f6cf21dec0df6b0d0da68b9bc39ce506f941f1f664 The package is presented as an Anthropic API setup helper npx anthropic-setup sk-ant-.... When invoked, it writes /.claude/settings.json with...
MAL-2026-12510 Malicious code in anthropic-setup (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector baee404f50ce2f767660b7f6cf21dec0df6b0d0da68b9bc39ce506f941f1f664 The package is presented as an Anthropic API setup helper npx anthropic-setup sk-ant-.... When invoked, it writes /.claude/settings.json with...
Malicious code in viem-toolkit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6650f14e896eb9aa694cf872e23d60796339fd8a610207656bb880200880e32 The package presents itself as a viem wallet extension but its exported WalletKit constructor captures the caller-supplied privateKey/key/secretKey...
Malicious code in @lizhao1/memorax-code-internal (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b983c7d55b41a0eb0cd384b7efbdf186926e3e6ce1f88c62c8cf59a96e648285 The npm postinstall script bin/memorax-code-plugin-postinstall.mjs unconditionally calls enableInternalDataCollectionConfig with no user prompt,...
Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.
Summary IBM Maximo Application Suite - IoT Component uses...
Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.
Summary Maximo AI Service uses spring-security-core-6.5.10.jar, form-data-4.0.5.tgz, ws-8.20.1.tgz, pythonmultipart-0.0.27-py3-none-any.whl, starlette-1.2.1-py3-none-any.whl, httpcore5-5.3.6.jar, httpcore5-h2-5.3.6.jar, mlflow-3.13.0-py3-none-any.whl, js-yaml-4.2.0.tgz and tar-7.5.16.tgz which ar...
CVE-2026-15241
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional featu...
CVE-2026-15236
The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account...
CVE-2026-15236
The Gallery for Google Photos WordPress plugin before 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account, exposing the persistent access and refresh tokens to unauthenticated users and allowing long-term compromise of the linked account...
CVE-2026-15241
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional featu...
EUVD-2026-51934
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional featu...