Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the /ureport/datasource/testConnection endpoint. An authenticated user can access internal network resources by sending a malicious GET request. Remediation There is no fixed version for...

Malicious code in hardhat-starter-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 127bcfdba774e2dd942b89041f670f62c7523c32b766606d81a1b229b961b1a4 The package hardhat-starter-kit was found to contain malicious code...

MAL-2026-2769 Malicious code in hardhat-starter-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 127bcfdba774e2dd942b89041f670f62c7523c32b766606d81a1b229b961b1a4 The package hardhat-starter-kit was found to contain malicious code...

Malicious code in ccip-starter-kit-hardhat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18950b48cb8b769d2cda9645f7c64f05698aad343186a22e3a84af7662856c39 The package ccip-starter-kit-hardhat was found to contain malicious code...

MAL-2026-2739 Malicious code in ccip-starter-kit-hardhat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18950b48cb8b769d2cda9645f7c64f05698aad343186a22e3a84af7662856c39 The package ccip-starter-kit-hardhat was found to contain malicious code...

Malicious code in agent-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aef6858e2b8d9f7b68d47f8549836f84751b481c19980557a6c83c1954a0313f The package agent-starter was found to contain malicious code...

MAL-2026-2727 Malicious code in agent-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aef6858e2b8d9f7b68d47f8549836f84751b481c19980557a6c83c1954a0313f The package agent-starter was found to contain malicious code...

GHSA-4FP2-3XGG-JG4W PowerJob vulnerable to SQL injection

A vulnerability was identified in PowerJob 5.1.0/5.1.1/5.1.2. Impacted is an unknown function of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/InstanceController.java of the component detailPlus Endpoint. The manipulation of the argument...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the customQuery argument in the detailPlus endpoint. An attacker can execute arbitrary SQL commands by supplying crafted input remotely. Remediation There is no fixed version for tech.powerjob:powerjob-server-starter...

tech.powerjob:powerjob-server-starter (>=4.3.1, <=5.1.7) potentially affected by CVE-2026-5739 via tech.powerjob:powerjob-server-core (>=4.3.1, <=5.1.7)

tech.powerjob:powerjob-server-core MAVEN version =4.3.1, =4.3.1, =5.1.7 Source cves: CVE-2026-5739 Source advisory: SNYK:JAVA-TECHPOWERJOB-15928844...

CVE-2026-4549

A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-portal.ts of the component Stripe API. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-4269

A missing S3 ownership verification in the Bedrock AgentCore Starter Toolkit before version v0.1.13 may allow a remote actor to inject code during the build process, leading to code execution in the AgentCore Runtime. This issue only affects users of the Bedrock AgentCore Starter Toolkit before...

EUVD-2026-14306

A vulnerability was detected in mickasmt next-saas-stripe-starter 1.0.0. Affected by this vulnerability is the function updateUserrole of the file actions/update-user-role.ts. The manipulation of the argument userId/role results in improper authorization. The attack may be launched remotely...

EUVD-2026-14304

A security vulnerability has been detected in mickasmt next-saas-stripe-starter 1.0.0. Affected is the function generateUserStripe of the file actions/generate-user-stripe.ts of the component Checkout Handler. The manipulation of the argument priceId leads to business logic errors. The attack may...

CVE-2026-4549

A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-portal.ts of the component Stripe API. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-4547

A security vulnerability has been detected in mickasmt next-saas-stripe-starter 1.0.0. Affected is the function generateUserStripe of the file actions/generate-user-stripe.ts of the component Checkout Handler. The manipulation of the argument priceId leads to business logic errors. The attack may...

CVE-2026-4548

A vulnerability was detected in mickasmt next-saas-stripe-starter 1.0.0. Affected by this vulnerability is the function updateUserrole of the file actions/update-user-role.ts. The manipulation of the argument userId/role results in improper authorization. The attack may be launched remotely...

CVE-2026-4549 mickasmt next-saas-stripe-starter Stripe API open-customer-portal.ts openCustomerPortal authorization

A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-portal.ts of the component Stripe API. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-4549

A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-portal.ts of the component Stripe API. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The...

CVE-2026-4549 mickasmt next-saas-stripe-starter Stripe API open-customer-portal.ts openCustomerPortal authorization

A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-portal.ts of the component Stripe API. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The...