GHSA-P4GQ-832X-FM9V vulnerabilities

Vulnerabilities for packages: open-webui, apache-beam-python-3.12-sdk, label-studio, apache-beam-python-3.13-sdk, nemo, apache-beam-python-3.11-sdk, py3-nltk...

CVE-2026-54293 vulnerabilities

Vulnerabilities for packages: open-webui, apache-beam-python-3.12-sdk, label-studio, apache-beam-python-3.13-sdk, nemo, apache-beam-python-3.11-sdk, py3-nltk...

CVE-2026-59807

Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt...

CVE-2026-59807

Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt...

CVE-2026-59807 Composio SDK < 0.2.32-beta.283 - Sensitive File Upload via tool-file-uploads.ts

Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt...

CVE-2026-59807 Composio SDK < 0.2.32-beta.283 - Sensitive File Upload via tool-file-uploads.ts

Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt...

EUVD-2026-42377

Composio SDK before 0.2.32-beta.283 contains a path validation bypass vulnerability that allows attackers to read and exfiltrate sensitive files by exploiting a missing assertSafeFileUploadPath check in the readFileFromDisk function within tool-file-uploads.ts. Attackers can exploit prompt...

CVE-2026-59807

CVE-2026-59807 affects Composio SDK prior to 0.2.32-beta.283. A path validation bypass in readFileFromDisk (tool-file-uploads.ts) can enable an attacker to read and exfiltrate sensitive files by manipulating file_uploadable parameters via prompt injection, referencing sensitive paths such as SSH ...

MAL-2026-7000 Malicious code in pipo-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 259159c0505b819905dcaf53172d98a4fd590a9ae1a40f87d2be4c1a7fdc4065 This package is a dependency-confusion payload published at an abnormally high version 9999.0.0 targeting an internal package name pipo-sdk. The...

MAL-2026-6997 Malicious code in goofy-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 779daa3389f4ff3ea7ca2acb4e0202b4465e90fa0d8b7bdcc0e3785f34e454a2 [email protected] is a dependency-confusion squat: the version is inflated to 9999.0.0 to shadow an internal package of the same name in build syste...

MAL-2026-6993 Malicious code in bytefaas-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07cb4f68cec68081ac4817ad2ae387e7b031d3377a74a74ecca59c5858940d08 Package published at version 9999.0.0 under the name bytefaas-sdk, the canonical dependency-confusion shape used to shadow a private internal package...

ROOT-APP-PYPI-CVE-2026-48776 CVE-2026-48776 in rootio-langgraph-sdk - Patched by Root

Root has patched CVE-2026-48776 in the rootio-langgraph-sdk package for Root:PyPI. Multiple fixed versions available...

@knocklabs/client (>=0.21.6, <=0.22.1), @knocklabs/expo (>=0.5.0, <=0.8.1) +8 more potentially affected by CVE-2026-56812 via phoenix (>=1.8.0, <=1.8.7)

phoenix NPM version =1.8.0, =0.21.6, =0.5.0, =0.1.0, =0.1.1, =0.1.1, =0.0.2, =0.0.1, =0.0.2, =0.0.1, =2.1.8, =2.5.4 Source cves: CVE-2026-56812 Source advisory: SNYK:JS-PHOENIX-17889828...

Security Bulletin: QRadar App SDK for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Investigation Assistant App for IBM QRadar App SDK has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-39892 DESCRIPTION:...

GO-2026-5764 DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream

DoS due to Panic in AWS SDK for Go v2 SDK EventStream Decoder in github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream...

SageMaker Python SDK has Insecure TLS Configuration

SummarySageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where SSL certificate verification was globally disabled in the Triton Python backend has been found. ImpactArbitrary Code Execution: Disabling SSL verification...

PYSEC-2026-1886 SageMaker Python SDK has Insecure TLS Configuration

Summary SageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where SSL certificate verification was globally disabled in the Triton Python backend has been found. Impact Arbitrary Code Execution: Disabling SSL verification...

Malicious code in paysafe-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12ef2b75345902c9fe851d85e09c4b6680a3685669ab4dcd8b827ebaebb46626 Package metadata claims to be the 'Official Paysafe SDK for Python' by 'Paysafe Developer Team', but the shipped module is a stealer disguised as a...

Malicious code in chai-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9192d163b3814064c95a23cb11e218732346628f3109517aab7697c2dcb6d016 On require, index.js spawns a detached background node process that runs lib/initializeCaller.js. That module axios.gets a base64-obfuscated URL...

MAL-2026-6931 Malicious code in chai-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9192d163b3814064c95a23cb11e218732346628f3109517aab7697c2dcb6d016 On require, index.js spawns a detached background node process that runs lib/initializeCaller.js. That module axios.gets a base64-obfuscated URL...