Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the processing of plugin parameters. An attacker can cause sensitive input data to be recorded in audit logs by submitting requests with malformed values in the TypeKVPair or TypeHeade...

Incorrect Authorization

Overview github.com/openbao/openbao/sdk/v2/helper/identitytpl is a None Affected versions of this package are vulnerable to Incorrect Authorization. in the access control evaluation process. An attacker can gain unauthorized access to restricted paths by crafting identity metadata containing...

llm-observer-proxy (0.1.0), nexa-gauge (0.1.19) +3 more potentially affected by CVE-2026-84377 via litellm (>=1.90.0, <=1.90.3)

litellm PYPI version =1.90.0, =0.4.7, =2.106.3, =0.1.0, =0.1.1 Source cves: CVE-2026-84377 Source advisory: OSV:PYSEC-2026-4066...

llm-observer-proxy (0.1.0), nexa-gauge (0.1.19) +3 more potentially affected by CVE-2026-84377 via litellm (>=1.90.0, <=1.90.3)

litellm PYPI version =1.90.0, =0.4.7, =2.106.3, =0.1.0, =0.1.1 Source cves: CVE-2026-84377 Source advisory: OSV:GHSA-3CV6-JPF6-8222...

llm-observer-proxy (0.1.0), nexa-gauge (0.1.19) +3 more potentially affected by CVE-2026-84377 via litellm (>=1.90.0, <=1.90.3)

litellm PYPI version =1.90.0, =0.4.7, =2.106.3, =0.1.0, =0.1.1 Source cves: CVE-2026-84377 Source advisory: GHSA-3CV6-JPF6-8222...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the templated policy processing. An attacker can gain unauthorized access, escalate privileges, or issue unauthorized certificates by injecting wildcard or syntax-significant characters into identity data...

llm-observer-proxy (0.1.0), nexa-gauge (0.1.19) +3 more potentially affected by CVE-2026-84377 via litellm (>=1.90.0, <=1.90.3)

litellm PYPI version =1.90.0, =0.4.7, =2.106.3, =0.1.0, =0.1.1 Source cves: CVE-2026-84377 Source advisory: SNYK:PYTHON-LITELLM-19644158...

Malicious Package

Overview bucket-protocol-sdk-v2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malware in bucket-protocol-sdk-v2

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in bucket-protocol-sdk-v2 (npm)

Source: amazon-inspector e19ff8a6cb5a08bd0561658d41dfe3616f1680bc5acac989c97da38f37ee41b4 bucket-protocol-sdk-v2 advertises itself as a 'community maintained drop-in replacement' for the Sui ecosystem's bucket-protocol-sdk, but its src/ tree contains only empty stubs bucket.ts: export ;, index.ts...

Malicious code in aliyun-python-sdk-v2 (PyPI)

Source: kam193 29bd2455a576643c51939bd166abab847afd04c3142b576e3f9f0c7978763181 Series of packages impersonating Alibaba Cloud. Two oldest hide code to run obfuscated code, but are likely to be used as dependency as the obfuscated code is not inside. The newest describe similar functionality, but...

GO-2026-5764 DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream

DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream...

Malware in pino-sdk-v2

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @validate-sdk/v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e93b483fd9338717a984d2e695d44a5497cb4b2d1a91c0eabc160fbc6d6cd7aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @validate-sdk/v2

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in pino-sdk-v2 (npm)

Malware detected: Exfiltrates .env file keys to Discord webhook. Impersonates legit pino package with modified malicious package/lib/tools.js. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 093fa98258b33a735216506ea119532a3cc24c92359028b4bb1955d0b712951a The...

EUVD-2023-43649

Malicious code in bioql PyPI...

Malware in appboy-web-sdk-v2

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Realtek AP-Router SDK Input Validation Error Vulnerability

The Realtek AP-Router SDK is a software package for wireless chipsets from Realtek Semiconductor Realtek of China. An input validation error vulnerability exists in the Realtek AP-Router SDK, which stems from an integer overflow vulnerability in the boa updateConfigIntoFlash function, which can...

acedit (1.0.0), allennlp (>=0.4.0, <=0.4.1) +45 more potentially affected by CVE-2023-41419 via gevent (1.2.2)

gevent PYPI version 1.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on gevent and may be impacted: - acedit 1.0.0 - allennlp =0.4.0, =0.7.0, =0.5.7, =11.0.3, =11.0.2, =11.0.2, =11.0.2, =11.0.2, =11.0.2, =11.0.2, =11.0.2, =11.0.2, =11.0.6 and more...