Malicious code in @helloflex/widget-next-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ca9fce3cc7390ed9fa54426eb0404651c2679a146b83aaf537d0d4c4cf9ba2c The package @helloflex/widget-next-sdk was found to contain malicious code. Source: ghsa-malware...

Silicon Labs Simplicity SDK 安全漏洞

Silicon Labs Simplicity SDK is a core software development kit provided by Silicon Labs, Inc. in the United States. The Silicon Labs Simplicity SDK has a security vulnerability. This vulnerability arises from truncated 802.15.4 packet data, which may lead to assertion failures and potentially cau...

CVE-2026-25536

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless...

EUVD-2026-5335

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless...

CVE-2026-25536 @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2127 more potentially affected by CVE-2026-25536 via @modelcontextprotocol/sdk (>=1.10.0, <=1.25.3)

@modelcontextprotocol/sdk NPM version =1.10.0, =0.3.3, =1.0.0, =1.14.1, =1.0.0, =1.2.1, =0.1.4, =0.0.1, =0.0.1, =1.0.0, =1.1.0, =1.0.0, =1.0.0, =10.1.0-rc.1, =10.2.1 and more Source cves: CVE-2026-25536 Source advisory: SNYK:JS-MODELCONTEXTPROTOCOLSDK-15208843...

Race Condition

Overview @modelcontextprotocol/sdk is a Model Context Protocol implementation for TypeScript Affected versions of this package are vulnerable to Race Condition via the reuse of a single McpServer or Server instance and transport across multiple concurrent client connections. An attacker can acces...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2127 more potentially affected by CVE-2026-25536 via @modelcontextprotocol/sdk (>=1.10.0, <=1.25.3)

@modelcontextprotocol/sdk NPM version =1.10.0, =0.3.3, =1.0.0, =1.14.1, =1.0.0, =1.2.1, =0.1.4, =0.0.1, =0.0.1, =1.0.0, =1.1.0, =1.0.0, =1.0.0, =10.1.0-rc.1, =10.2.1 and more Source cves: CVE-2026-25536 Source advisory: OSV:GHSA-345P-7CG4-V4C7...

Malicious code in rreact-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 545745c49f65687bb4f76d176081253cf22e6a0400a6ef46167d730b2c6bc5af The package rreact-sdk was found to contain malicious code. Source: ghsa-malware 20062321714f0ca22d7f2eb77967ff272ade6afac544812eaeacd15b918dbc11 Any...

Malicious Package

Overview rreact-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-715 Malicious code in rreact-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 545745c49f65687bb4f76d176081253cf22e6a0400a6ef46167d730b2c6bc5af The package rreact-sdk was found to contain malicious code. Source: ghsa-malware 20062321714f0ca22d7f2eb77967ff272ade6afac544812eaeacd15b918dbc11 Any...

CVE-2026-1778

Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 disables TLS certificate verification for HTTPS connections made by the service when a Triton Python model is imported, incorrectly allowing for requests with invalid and self-signed certificates to succeed...

binarium (2.1.3), hunter-open-sdk (>=0.0.20, <=2.0.0-beta.25) potentially affected by CVE-2026-24884 via compressing (2.0.0)

compressing NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on compressing and may be impacted: - binarium 2.1.3 - hunter-open-sdk =0.0.20, =2.0.0-beta.25 Source cves: CVE-2026-24884 Source advisory: SNYK:JS-COMPRESSING-15202444...

binarium (2.1.3), hunter-open-sdk (>=0.0.20, <=2.0.0-beta.25) potentially affected by CVE-2026-24884 via compressing (2.0.0)

compressing NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on compressing and may be impacted: - binarium 2.1.3 - hunter-open-sdk =0.0.20, =2.0.0-beta.25 Source cves: CVE-2026-24884 Source advisory: OSV:GHSA-CC8F-XG8V-72M3...

CVE-2026-1664

Summary An Insecure Direct Object Reference has been found to exist in createHeaderBasedEmailResolver function within the Cloudflare Agents SDK. The issue occurs because the Message-ID and References headers are parsed to derive the target agentName and agentId without proper validation or origin...

CVE-2026-1664 Insecure Direct Object Reference (IDOR) via Header-Based Email Routing

Summary An Insecure Direct Object Reference has been found to exist in createHeaderBasedEmailResolver function within the Cloudflare Agents SDK. The issue occurs because the Message-ID and References headers are parsed to derive the target agentName and agentId without proper validation or origin...

CVE-2026-1664

Summary: CVE-2026-1664 affects Cloudflare Agents SDK prior to 0.3.7, due to an IDOR in header-based email routing. Root cause: createHeaderBasedEmailResolver() parses Message-ID and References to derive target agentName/agentId without cryptographic/origin verification, letting external headers s...

CVE-2026-1664 Insecure Direct Object Reference (IDOR) via Header-Based Email Routing

Summary An Insecure Direct Object Reference has been found to exist in createHeaderBasedEmailResolver function within the Cloudflare Agents SDK. The issue occurs because the Message-ID and References headers are parsed to derive the target agentName and agentId without proper validation or origin...

GHSA-RJRP-M2JW-PV9C SageMaker Python SDK has Exposed HMAC

Summary SageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where the HMAC secret key is stored in environment variables and disclosed via the DescribeTrainingJob API has been identified. Impact - Function and Payload...

GHSA-62RC-F4V9-H543 SageMaker Python SDK has Insecure TLS Configuration

Summary SageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where SSL certificate verification was globally disabled in the Triton Python backend has been found. Impact Arbitrary Code Execution: Disabling SSL verification...