MAL-2026-17275 Malicious code in @hrmony/pladddform-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e9e61c4d5d499198c568d9f255e23b407eb7e47f7272c76bf5f50a0d0db31605 On top-level module load, index.js queries the AWS instance metadata service at 169.254.169.254 IMDSv2, retrieves the instance identity document,...

CVE-2026-75884

A flaw was found in AWX. The container group podspecoverride field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can...

CVE-2026-75884

A flaw was found in AWX. The container group podspecoverride field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can...

CVE-2026-75884: Incomplete List of Disallowed Inputs

A flaw was found in AWX. The container group podspecoverride field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can...

Malicious code in soltinel-pro (npm)

Source: amazon-inspector 01f489c47a35cb393c976988c8f12eb9b47cddac13ae4112b019adad4eefb646 postinstall.cjs is declared as the package.json postinstall script and runs automatically on npm install. The script walks parent directories for.env files filtering values by KEY/SECRET/PRIVATE/TOKEN, reads...

Malicious code in soltinel-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01f489c47a35cb393c976988c8f12eb9b47cddac13ae4112b019adad4eefb646 postinstall.cjs is declared as the package.json postinstall script and runs automatically on npm install. The script walks parent directories for.env...

MAL-2026-16096 Malicious code in soltinel-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01f489c47a35cb393c976988c8f12eb9b47cddac13ae4112b019adad4eefb646 postinstall.cjs is declared as the package.json postinstall script and runs automatically on npm install. The script walks parent directories for.env...

CVE-2026-57866

Apache Impala versions 4.4.x and 4.5.x are vulnerable to a Server Side Request Forgery (SSRF) . Authenticated users authorized to execute the ai_generate_text() function can exfiltrate secrets from credential providers defined in the hadoop.security.credential.provider.path property of core-site....

CVE-2026-57866 Apache Impala: Secrets Exfiltration via SSRF

Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the aigeneratetext function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of...

CVE-2026-57866 Apache Impala: Secrets Exfiltration via SSRF

Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the aigeneratetext function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of...

CVE-2026-57866 Apache Impala: Secrets Exfiltration via SSRF

Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the aigeneratetext function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of...

GHSA-VX52-2968-3VC6 pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

Summary pnpm expands $VAR environment placeholders in the httpProxy / httpsProxy / noProxy settings read from a project's pnpm-workspace.yaml. Because a project manifest is repository-controlled, a malicious repository that a victim merely clones and runs pnpm install in can route all install...

PT-2026-82767

Name of the Vulnerable Software and Affected Versions Ceph versions prior to 20.2.4 Ceph versions prior to 19.2.6 Description The Monitor subscription handler fails to properly authorize access to the configuration-key store. A CephX user with mon allow r capabilities can read the entire store by...

CVE-2026-75910 Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

CVE-2026-76227 Renovate 42.68.1 before 42.96.3 and 43.0.0 before 43.4.4 Environment Variable Exposure

Renovate versions from 42.68.1 before 42.96.3 and from 43.0.0 before 43.4.4, including the renovate/renovate Docker images, and Mend Renovate CE/EE images renovate-ce, renovate-ee-server, renovate-ee-worker from 13.3.0 before 13.6.0, fail to restrict environment variables to an allowlist when...

MAL-2026-14120 Malicious code in blastradar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3eccd07c931ee578e1201f5fbb7f4610fd5291202c0fcee2b30c959c80c871e The package's index.js loads childprocess, https, and fs at the top level and performs an HTTPS POST that carries host- and installer-identifying dat...

GHSA-2QVG-QR73-MQXP conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target

Impact Versions of conflibot before 1.2.1 build git commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names head.ref, which are attacker-controlled: anyone can open a pull request including from a fork whose head branch name...

PT-2026-76719

Impact Versions of conflibot before 1.2.1 build git commands by string interpolation and run them through a shell. Several of the interpolated values are pull request branch names head.ref, which are attacker-controlled: anyone can open a pull request including from a fork whose head branch name...

MAL-2026-14083 Malicious code in heft-storybook-v6-react-tutorial-storykit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb5955868f72344703128add3301e3a85b51773de502f24e636fe0b9bba86d42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zzzgenesis00/solana-wallet-adapter (npm)

Source: amazon-inspector 313cd424f27cb12cf28c0ad6737c2b2d5b08ff37d8971ae65a3a0184a73d2c46 The postinstall.js script, which runs automatically on npm install, harvests a broad set of installer-owned secrets and identity data and exfiltrates them to two hardcoded attacker-controlled destinations...