MAL-2026-12402 Malicious code in new-native-tools-linux-x64-gnu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b38b165a8872e9c65dab5b230d8a4cc26e045f5fc3fd8502fd711652913af44a The package ships a single 10 MB Rust-compiled Linux x8664 N-API native module tools.linux-x64-gnu.node referenced by main, with a two-line README th...

Malicious code in streak-calc-metrics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91b37a5aa06b2d75f250bd23ce01f2667646c1aa7609ec2323f226842e043e9d [email protected] is presented as a native math accelerator for streak calculations but ships a bundled Linux ELF at dist/calc.bin that the...

Server-side Request Forgery (SSRF)

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the rawproxy. An attacker can...

CVE-2026-71211

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

CVE-2026-71211

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

CVE-2026-71211 mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint

MLflow's AI Gateway accepts an authconfig.apibase value when creating a gateway secret mlflow/server/handlers.py, creategatewaysecret with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint mlflow/server/gatewayapi.py, rawproxy subsequently issues...

CVE-2026-71211

MLflow’s AI Gateway allows an auth_config.api_base value to be stored without validation (scheme/host/IP range), and the gateway proxy endpoint then issues HTTP requests to api_base plus a caller-supplied path, returning the response body. The existing SSRF guard (_validate_webhook_url) is never ...

CVE-2026-71190

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The "qdtext" pattern ?:^"|\. allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in...

CVE-2026-71190

OpenStack Swift proxy server vulnerability CVE-2026-71190 affects Swift up to 2.38.0. The proxy Accept header parser uses a qdtext pattern (?:[^"]|\.)* that allows catastrophic backtracking (ReDoS). An unauthenticated remote attacker can craft an Accept header to trigger exponential CPU usage, wh...

CVE-2026-71190

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The "qdtext" pattern ?:^"|\. allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in...

CVE-2026-71190

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The "qdtext" pattern ?:^"|\. allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in...

CVE-2026-71190

In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The "qdtext" pattern ?:^"|\. allows an unauthenticated remote attacker to send a crafted Accept header that causes exponential CPU consumption in...

Linux Distros Unpatched Vulnerability : CVE-2026-71190

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In OpenStack Swift through 2.38.0, the proxy server Accept header parser contains a regular expression vulnerable to catastrophic backtracking ReDoS. The qdtext...

CVE-2026-16728

A flaw was found in undici. A malicious or faulty upstream server could send a partial response with incorrect length information. When undici's retry interceptor processes this, it may create a response body with a length that does not match the original Content-Length header. This can lead to...

CVE-2026-69192 vulnerabilities

Vulnerabilities for packages: renovate, sqlpad, kubeflow-pipelines, prism, langfuse, unleash-fips, unleash, unleash-proxy, librechat, wazuh-dashboard, opensearch-dashboards, pulumi, actions-runner, graalvm, code-server, wazuh-dashboard-fips, npm, langfuse-fips, opensearch-dashboards-fips, lerna,...

CVE-2026-54272 vulnerabilities

Vulnerabilities for packages: renovate, sqlpad, kubeflow-pipelines, prism, langfuse, unleash-fips, unleash, unleash-proxy, librechat, wazuh-dashboard, opensearch-dashboards, pulumi, actions-runner, graalvm, code-server, wazuh-dashboard-fips, npm, langfuse-fips, opensearch-dashboards-fips, lerna,...

GHSA-22JQ-VG5J-6VGG vulnerabilities

Vulnerabilities for packages: renovate, sqlpad, kubeflow-pipelines, prism, langfuse, unleash-fips, unleash, unleash-proxy, librechat, wazuh-dashboard, opensearch-dashboards, pulumi, actions-runner, graalvm, code-server, wazuh-dashboard-fips, npm, langfuse-fips, opensearch-dashboards-fips, lerna,...

CVE-2026-69198 vulnerabilities

Vulnerabilities for packages: renovate, sqlpad, kubeflow-pipelines, prism, langfuse, unleash-fips, unleash, unleash-proxy, librechat, wazuh-dashboard, opensearch-dashboards, pulumi, actions-runner, graalvm, code-server, wazuh-dashboard-fips, npm, langfuse-fips, opensearch-dashboards-fips, lerna,...

GHSA-4XRF-JV44-H6HH vulnerabilities

Vulnerabilities for packages: renovate, sqlpad, kubeflow-pipelines, prism, langfuse, unleash-fips, unleash, unleash-proxy, librechat, wazuh-dashboard, opensearch-dashboards, pulumi, actions-runner, graalvm, code-server, wazuh-dashboard-fips, npm, langfuse-fips, opensearch-dashboards-fips, lerna,...

GHSA-MWP4-54F8-5FHR vulnerabilities

Vulnerabilities for packages: renovate, sqlpad, kubeflow-pipelines, prism, langfuse, unleash-fips, unleash, unleash-proxy, librechat, wazuh-dashboard, opensearch-dashboards, pulumi, actions-runner, graalvm, code-server, wazuh-dashboard-fips, npm, langfuse-fips, opensearch-dashboards-fips, lerna,...