Malicious code in dext-crate-image (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e581bed6c9028ebf84b341f914135c1af62bc9b75072f1c511c4c187cb94abfd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in dext-crate-video (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3becb032c5eb2c6055f81b9fc5dbd5d5c517d1c4028810110bd1b202ec4742e5 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14406 Malicious code in dext-crate-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 329047f71cd6b35084bea7ed22978ba88e02cb557a5490b6133a70a5a0859a19 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @blurrydespair/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7ff09078e56bd40b5ad38f72027a55a39067b82aaffb0bfe6891e3d6d912e8 Package advertises itself as 'Open Whisper Systems libsignal for Node.js' but ships an install.js that has nothing to do with libsignal. On require o...

MAL-2026-14404 Malicious code in @blurrydespair/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7ff09078e56bd40b5ad38f72027a55a39067b82aaffb0bfe6891e3d6d912e8 Package advertises itself as 'Open Whisper Systems libsignal for Node.js' but ships an install.js that has nothing to do with libsignal. On require o...

Astra Linux – Vulnerability in Tomcat9

A vulnerability related to observable timing discrepancies occurs when comparing AJP secrets in Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109...

autonoma

Autonoma Autonoma rileva segreti hardcoded e li sostituisce con riferimenti aos.environ... utilizzando riscritture AST. Le modifiche vengono applicate solo quando la riscrittura è deterministica e preserva la semantica. Le riscritture utilizzano l'albero sintattico analizzato — non espressioni...

dredge-cargo

Dies ist KEIN Passwort-Manager. KEINE Notizen-App. Und definitiv KEINE taxonomische Herkunftsregistrierung für benthische Tiefsee-Abnormitäten. Aber die ersten beiden macht es besser als beide. Nur ein Scherz nicht wirklich. Installieren • Schnellstart • Funktionen • Der Link-Befehl • Befehle • S...

GitLeaks

Componente GitLeaks GitLab CI Um componente GitLab CI para Gitleaks - uma ferramenta SAST para detetar e prevenir segredos codificados como palavras-passe, chaves de API e tokens em repositórios git. Funcionalidades Deteção de Segredos : Analisa repositórios em busca de segredos codificados e...

Malicious code in svelte-dim-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1857f7f4957bdb18eb0d5a997d957a38b825b62660f16d6a981232794cc10af0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

gimmepatz

😼 gimmePATz 😼 - Strumento di ricognizione per Personal Access Token PAT Ti è mai capitato di trovare un personal access token PAT di GitHub o NPM e chiederti "Sarà valido?" oppure "Chissà cosa potrebbe farci un malintenzionato?" Beh, se è così, ho lo strumento che fa per te! Ti presento gimmePatz...

Malicious code in @postman-cse/okta-aio-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05a2f9288ce6a37525823a4f4d41e8a4aaeaea4b0c6e18e6a356bd9d6f49162e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-62677

Omnigent , an open-source AI agent framework for orchestrating coding agents, is vulnerable to arbitrary host filesystem access prior to version 0.3.0. An authenticated user can upload a session-scoped agent bundle with an absolute or traversal-containing os_env.cwd value. The parser (omnigent/sp...

CVE-2026-55622

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new projec...

CVE-2026-55622 Incus has a project restriction bypass in instance copy across projects

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new projec...

CVE-2026-55621 Incus has a project restriction bypass for custom volume copy across projects

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume t...

CVE-2026-55621 Incus has a project restriction bypass for custom volume copy across projects

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for custom volume copying where an attacker knowing the name of a project that they don't have access to and the name of a custom volume in that project can copy the custom volume t...

CVE-2026-75910

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

EUVD-2026-63585

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...

CVE-2026-75910 Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template

Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an...