trivy v0.74.0

📖 Documentation Trivy pronunciation is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues. Targets what Trivy can scan: Container Image Filesystem Git Repository remote Virtual Machine Image Kubernetes...

MAL-2026-14051 Malicious code in @velliajs/discord (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c86edd3f7edd7d111df5621cb884fd0ef3d870c6c0719d587b7bb0f16f65b8d The package presents itself as a discord.js clone repository field points at the real github.com/discordjs/discord.js.git, README instructs import...

Malicious code in @velliajs/discord (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c86edd3f7edd7d111df5621cb884fd0ef3d870c6c0719d587b7bb0f16f65b8d The package presents itself as a discord.js clone repository field points at the real github.com/discordjs/discord.js.git, README instructs import...

keyhog v0.5.73-action

Website · Documentation · Architecture · Vyre GPU engine KeyHog: GPU-accelerated secret scanner for code, cloud, and CI KeyHog is an open-source secret scanner in Rust that finds and verifies leaked API keys, tokens, passwords, and credentials across source code, Git history, containers, cloud...

Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Summary token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. The get-user-info operation accepts a user-controlled username argument and later interpolates it into a shell command executed through execAsync: ts getent passwd "$username" || grep "^$username:" /etc/passw...

GHSA-49MQ-FC6Q-3H46 Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Summary token-optimizer-mcp is vulnerable to OS command injection in the smartuser tool. The get-user-info operation accepts a user-controlled username argument and later interpolates it into a shell command executed through execAsync: ts getent passwd "$username" || grep "^$username:" /etc/passw...

Metasploit Wrap Up: Lot of summer shells and fit http profiles

This wrap-up brings a full-on shell parade. Thirteen shiny new modules landed, starting with a buffet of RCEs. WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard, a Pix-for-WooCommerce, and for those who like their exploits closer to...

CVE-2026-73682

Semaphore versions prior to 2.18.20 contain an OS command injection argument injection vulnerability in the repository giturl handling that allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. Attackers can craf...

CVE-2026-73682 Semaphore prior to version 2.18.20 OS Command Injection via git_url Repository Handling

Semaphore versions prior to 2.18.20 contain an OS command injection argument injection vulnerability in the repository giturl handling that allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. Attackers can craf...

EUVD-2026-58809

Semaphore versions prior to 2.18.20 contain an OS command injection argument injection vulnerability in the repository giturl handling that allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. Attackers can craf...

CVE-2026-73682 Semaphore prior to version 2.18.20 OS Command Injection via git_url Repository Handling

Semaphore versions prior to 2.18.20 contain an OS command injection argument injection vulnerability in the repository giturl handling that allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. Attackers can craf...

GO-2026-6089 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53recoveryreadiness-fips, kubernetes-event-exporter, crossplane-provider-aws-route53recoveryreadiness, mc-fips, temporal, cert-manager, semaphore, crossplane-provider-aws-macie2, tailscale, yunikorn-k8shim-fips, crossplane-provider-aws-km...

GO-2026-6090 vulnerabilities

Vulnerabilities for packages: mc-fips, dkron-fips, yunikorn-k8shim-fips, crossplane-provider-aws-dax, redpanda, kgateway, crossplane-provider-aws-ssm, rqlite-fips, k6-fips, terraform-provider-sendgrid-fips, crossplane-provider-aws-cloudwatch-fips, cass-operator-fips-no-pvc-delete,...

GO-2026-6218 vulnerabilities

Vulnerabilities for packages: mc-fips, dkron-fips, yunikorn-k8shim-fips, crossplane-provider-aws-dax, redpanda, kgateway, crossplane-provider-aws-ssm, rqlite-fips, k6-fips, terraform-provider-sendgrid-fips, crossplane-provider-aws-cloudwatch-fips, cass-operator-fips-no-pvc-delete,...

CVE-2026-56862 vulnerabilities

Vulnerabilities for packages: mc-fips, dkron-fips, yunikorn-k8shim-fips, crossplane-provider-aws-dax, redpanda, kgateway, crossplane-provider-aws-ssm, rqlite-fips, k6-fips, terraform-provider-sendgrid-fips, crossplane-provider-aws-cloudwatch-fips, cass-operator-fips-no-pvc-delete,...

CVE-2026-56853 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53recoveryreadiness-fips, kubernetes-event-exporter, crossplane-provider-aws-route53recoveryreadiness, mc-fips, temporal, cert-manager, semaphore, crossplane-provider-aws-macie2, tailscale, yunikorn-k8shim-fips, crossplane-provider-aws-km...

CVE-2026-56860 vulnerabilities

Vulnerabilities for packages: mc-fips, dkron-fips, yunikorn-k8shim-fips, crossplane-provider-aws-dax, redpanda, kgateway, crossplane-provider-aws-ssm, rqlite-fips, k6-fips, terraform-provider-sendgrid-fips, crossplane-provider-aws-cloudwatch-fips, cass-operator-fips-no-pvc-delete,...

CVE-2026-33818 vulnerabilities

Vulnerabilities for packages: wave, vale, flux-kustomize-controller, grafana-mimir, crossplane-provider-keycloak, github-mcp-server, cass-operator, falco-no-driver, argo-cd, rancher-agent, cloud-sql-proxy, kbld, crossplane-provider-aws-eks, migrate, aws-nuke, controller-gen, aws-flb-firehose,...

GO-2026-6090 vulnerabilities

Vulnerabilities for packages: wave, vale, flux-kustomize-controller, grafana-mimir, crossplane-provider-keycloak, github-mcp-server, cass-operator, falco-no-driver, argo-cd, rancher-agent, cloud-sql-proxy, kbld, crossplane-provider-aws-eks, migrate, aws-nuke, controller-gen, aws-flb-firehose,...

CVE-2026-56862 vulnerabilities

Vulnerabilities for packages: wave, vale, flux-kustomize-controller, grafana-mimir, crossplane-provider-keycloak, github-mcp-server, cass-operator, falco-no-driver, argo-cd, rancher-agent, cloud-sql-proxy, kbld, crossplane-provider-aws-eks, migrate, aws-nuke, controller-gen, aws-flb-firehose,...