Malicious code in @gsas/gsas-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2242b683433d5fe37b3997185d251799a4606a456e516da08586775d11f0cb7e @gsas/[email protected] is a high-version public-registry squat targeting an internal @gsas/gsas-sdk name. package.json declares preinstall: node...

CVE-2026-76842

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

EUVD-2026-64848

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-76842 Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-76842

CVE-2026-76842 affects the Mercado Pago Node.js SDK (through 3.4.0 ). The payment, paymentRefund, advancedPayment, and disbursementRefund clients interpolate caller-supplied identifiers into API request paths via template literals without percent-encoding , so URL-structural characters (dot-dot, ...

dezlock-dump

dezlock-dump Extrai tudo de um jogo Source 2 em execução Deadlock, CS2, Dota 2 e gera um SDK C++ à prova de patches que resolve offsets em tempo de execução. Sem valores fixos, sem atualizações manuais quando o jogo é atualizado. Início Rápido 1. Baixe da seção Releases ou compile a partir do...

sdk

@cosignet/sdk Client TypeScript leggero, zero dipendenze per Cosignet — approvazione human-in-the-loop per azioni ad alto rischio di agenti AI, con firme passkey vincolate al payload. Metti un umano nel loop prima che un'azione pericolosa venga eseguita: mettila in pausa, ottieni un'esplicita...

authproof-sdk

AuthProof SDK AuthProof è un protocollo di delegazione crittografica per l'IA agentica. La maggior parte dei protocolli in questo campo impongono l'applicazione di una policy definita dall'operatore, dando all'operatore l'autorità di espandere o reinterpretare l'intento originale dell'utente dopo...

Security Bulletin: IBM Db2 and IBM Java SDK used by IBM Security Verify Governance contain multiple vulnerabilities

Summary IBM Security Verify Governance ISVG, now re-branded as IBM Verify Identity Governance IVIG, uses IBM Db2 database and IBM Java SDK. Information about security vulnerabilities affecting IBM Db2 and IBM Java SDK has been published in security bulletins. Vulnerability Details Refer to the...

Fedora 44 : dotnet8.0 (2026-1397d83d94)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1397d83d94 advisory. Update to .NET SDK 8.0.130 and Runtime 8.0.30 Fixes:...

Fedora 43 : dotnet8.0 (2026-0db5bf0aae)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0db5bf0aae advisory. Update to .NET SDK 8.0.130 and Runtime 8.0.30 Fixes:...

Fedora 44 : dotnet9.0 (2026-7cfd54a4c1)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-7cfd54a4c1 advisory. Update to .NET SDK 9.0.120 and Runtime 9.0.19 Fixes:...

Fedora 44 : dotnet10.0 (2026-8b4cb2340a)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-8b4cb2340a advisory. Update to .NET SDK 10.0.111 and Runtime 10.0.11 Fixes:...

Fedora 43 : dotnet9.0 (2026-9c8770dffb)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-9c8770dffb advisory. Update to .NET SDK 9.0.120 and Runtime 9.0.19 Fixes:...

CVE-2026-77068

n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote code execution vulnerability in the @n8n/workflow-sdk node-schema loader used for MCP node-schema loading. The loader derives a node's schema module path directly from the attacker-supplied node type string without validating...

CVE-2026-77080 n8n before 1.123.69 Arbitrary File Read and Write via Snowflake

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes free-form Execute Query input, including client-side commands, directly to the Snowflake SDK without applying n8n's file-access restrictions...

CVE-2026-77080 n8n before 1.123.69 Arbitrary File Read and Write via Snowflake

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes free-form Execute Query input, including client-side commands, directly to the Snowflake SDK without applying n8n's file-access restrictions...

EUVD-2026-63268

n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an arbitrary file read and write vulnerability in the Snowflake node, which passes free-form Execute Query input, including client-side commands, directly to the Snowflake SDK without applying n8n's file-access restrictions...