Malicious code in react-dropzone-truffle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector deb9aafcb06b44346b4a153006bf1230d02f97d4f76ac2797f42a22005658c85 The package react-dropzone-truffle was found to contain malicious code. Source: ghsa-malware...

Malicious code in npm-security-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bf7ca4cfc33128c3d392d0df3b413365624b0e28a8215a7f0226ca4ec459730 The package npm-security-testing was found to contain malicious code. Source: ghsa-malware...

MAL-2026-997 Malicious code in npm-security-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bf7ca4cfc33128c3d392d0df3b413365624b0e28a8215a7f0226ca4ec459730 The package npm-security-testing was found to contain malicious code. Source: ghsa-malware...

Malicious code in rbxm-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89cc90689ea111d792b6dc071f39e060c440f492130ef599233cf0c4526f55e4 The package rbxm-tools was found to contain malicious code. Source: ghsa-malware 8b70ded43c5def740a34e33c94903aa957ced0450fffd844a1e0f0d4122aea94 Any...

MAL-2026-998 Malicious code in rbxm-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89cc90689ea111d792b6dc071f39e060c440f492130ef599233cf0c4526f55e4 The package rbxm-tools was found to contain malicious code. Source: ghsa-malware 8b70ded43c5def740a34e33c94903aa957ced0450fffd844a1e0f0d4122aea94 Any...

Path-Traversal-Lab

OS Path Traversal & System File Exfiltration 🎯 Executive S...

Path-Traversal-Lab

OS Path Traversal & System File Exfiltration 🎯 Executive S...

PT-2026-21640

Name of the Vulnerable Software and Affected Versions Airflow versions prior to 2.11.1 Description The software contains a flaw that permits authenticated users possessing audit log access to view sensitive values within audit logs that they are not authorized to see. Specifically, when sensitive...

CVE-2026-27574 OneUptime: node:vm sandbox escape in probe allows any project member to achieve RCE

OneUptime is a solution for monitoring and managing online services. In versions 9.5.13 and below, custom JavaScript monitor feature uses Node.js's node:vm module explicitly documented as not a security mechanism to execute user-supplied code, allowing trivial sandbox escape via a well-known...

CVE-2025-65995

When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values such as secrets, they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG. The issue...

CVE-2025-65995

In Apache Airflow , a vulnerability exists where a DAG failure during parsing causes the error-reporting mechanism in the UI to include full kwargs passed to operators. This can lead to the disclosure of sensitive values or secrets within the UI tracebacks to authenticated users who possess permi...

CVE-2025-65995

When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values such as secrets, they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG. The issue...

CVE-2025-65995 Apache Airflow: Disclosure of secrets to UI via kwargs

When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values such as secrets, they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG. The issue...

CVE-2026-26964

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to obtain Slack OAuth client secrets, which should only be accessible to workspace administrators. The GET...

CVE-2026-27004

OpenClaw is a personal AI assistant. Prior to version 2026.2.15, in some shared-agent deployments, OpenClaw session tools sessionslist, sessionshistory, sessionssend allowed broader session targeting than some operators intended. This is primarily a configuration/visibility-scoping issue in...

CVE-2026-26326

OpenClaw is a personal AI assistant. Prior to version 2026.2.14, skills.status could disclose secrets to operator.read clients by returning raw resolved config values in configChecks for skill requires.config paths. Version 2026.2.14 stops including raw resolved config values in requirement check...

CVE-2026-26202

Penpot is an open-source design tool for design and code collaboration. Prior to version 2.13.2, an authenticated user can read arbitrary files from the server by supplying a local file path e.g. /etc/passwd as a font data chunk in the create-font-variant RPC endpoint, resulting in the file...

Malicious code in rollup-plugin-polyfill-swc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae0f8211aafc83248f37c6f92d0be49953ca3a84aa2394b4aa8f5cd67f605a7e The package rollup-plugin-polyfill-swc was found to contain malicious code. Source: ghsa-malware...

MAL-2026-976 Malicious code in rollup-plugin-polyfill-swc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae0f8211aafc83248f37c6f92d0be49953ca3a84aa2394b4aa8f5cd67f605a7e The package rollup-plugin-polyfill-swc was found to contain malicious code. Source: ghsa-malware...

Malicious code in parse-compat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f14189ba3007a51617df87911f83c0c765d38bf6abe23b5aecbbe60cd8646c0a The package parse-compat was found to contain malicious code. Source: ghsa-malware 90a657719347c80f56dab387dd9beb25be7af98e9580382365a65feb0fd53243 A...