Malicious code in kartykp-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac4fed2b4d7ba3f64ee350b15e782732191843a11b1c5789218b0899da554f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16198 Malicious code in kartykp-token-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac4fed2b4d7ba3f64ee350b15e782732191843a11b1c5789218b0899da554f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-55149

Vouch Proxy is an SSO and OAuth/OIDC login gateway for Nginx. In versions prior to 0.48.0 (specifically v0.47.2), the Cookie() function in pkg/cookie/cookie.go parses the multipart cookie part count from an attacker-controlled cookie name and passes it unbounded to make([]string, N). A single una...

CVE-2026-55149: Memory Allocation with Excessive Size Value

Vouch Proxy is an SSO and OAuth/OIDC login solution for Nginx using the authrequest module. Prior to 0.48.0, Cookie in pkg/cookie/cookie.go parses the total part count from an attacker-controlled multipart cookie name and passes the value to makestring, numParts without checking that the value is...

CVE-2026-44300: Improper Input Validation

OpenCost provides cost monitoring for Kubernetes workloads and cloud costs. Prior to 1.121.0, the POST /serviceKey endpoint in pkg/costmodel/router.go allows a network client to invoke AddServiceKey without mandatory authentication and submit an arbitrary key form value that is written to the GCP...

CVE-2026-58196: Server-Side Request Forgery (SSRF)

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol MCP servers. Prior to 0.31.0, remote.Handler.Authenticate in pkg/auth/remote/handler.go invokes discovery.DetectAuthenticationFromServer in pkg/auth/discovery/discovery.go, whose host-side HTTP...

CVE-2026-54450: Server-Side Request Forgery (SSRF)

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol MCP servers. Prior to 0.29.1, networking.IsPrivateIP in pkg/networking/utilities.go omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, so NAT64 addresses embedding private, loopback, or...

CVE-2026-59157: Authentication Bypass by Spoofing

webhookd is a minimalist webhook server that triggers shell scripts and external processes through HTTP requests. Prior to 1.22.0, webhookd deployments without htpasswd authentication forwarded all incoming HTTP headers through HTTPParamsToShellVars in pkg/api/index.go into the hook script...

CVE-2026-44778: Improper Input Validation

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. From 0.28.0 until 0.53.1, the USDT note parser in pkg/uprobetracer/usdt.go can allow an unprivileged container to crash or exhaust the memory of the...

ipatool v2.6.0

ipatool is a command line tool that allows you to search for iOS, iPadOS, tvOS, visionOS, and macOS apps on the App Store, and download .ipa or macOS .pkg app packages. Requirements A supported operating system macOS, Linux, Windows or iOS. An Apple Account already configured to use the App Store...

Astra Linux – Vulnerability in edk2

Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to potentially enable escalation of privileges, denial of service, and/or information disclosure through physical access...

Astra Linux – Vulnerability in Golang 1.19, Golang 1.23

Creating a malicious file using cmd/go can result in writing to a file controlled by an attacker, with partial control over the file’s content. The cgo pkg-config: directive in a Go source file provides command-line arguments that are passed to the Go pkg-config command. An attacker can provide a...

The vulnerability of the BGP OPEN message parser in the pkg/packet/bbg module of the edge gateway protocol GoBGP allows a attacker to compromise the integrity of the protected information.

The vulnerability of the BGP OPEN message parser in the pkg/packet/bbg module of the edge gateway protocol GoBGP is related to the execution of operations beyond the buffer boundaries. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected...

ROOT-APP-GOBINARY-CVE-2026-73500 CVE-2026-73500 in go.etcd.io/etcd/client/pkg/v3 - Patched by Root

Root has patched CVE-2026-73500 in the go.etcd.io/etcd/client/pkg/v3 package for Root:Go. Multiple fixed versions available...

Malicious Package

Overview hydration-ui-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in hydration-ui-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d848dd11c0e0692f1f47c8fcb3cb0506316e96ab32f8b63a8913ad67e9570318 Package main dist/index.mjs locates dist/internal/mathcalc.mjs — a raw x8664 ELF binary shipped under an.mjs extension and described in the README as...

MAL-2026-15900 Malicious code in hydration-ui-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d848dd11c0e0692f1f47c8fcb3cb0506316e96ab32f8b63a8913ad67e9570318 Package main dist/index.mjs locates dist/internal/mathcalc.mjs — a raw x8664 ELF binary shipped under an.mjs extension and described in the README as...

CVE-2026-54766

Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/projectduplicate.go allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project...

CVE-2026-55569

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink with archives.FileInfo.LinkTarget without verifying that the target remains under the extraction destination. A later regular-file entry a...

CVE-2026-55108: Improper Link Resolution Before File Access

KubeVela is an open source application delivery platform. Prior to 1.9.14, from 1.10.0-alpha.1 until 1.10.9, and from 1.11.0-alpha.1 until 1.11.0-alpha.4, the Terraform remote configuration loader in pkg/controller/utils/capability.go, GetTerraformConfigurationFromRemote, clones a repository...