43618 matches found
GHSA-88FW-V6X4-3F58 vulnerabilities
Vulnerabilities for packages: apache-nifi-registry, camunda-zeebe...
GHSA-M4P7-R5RC-7G4J vulnerabilities
Vulnerabilities for packages: mlflow, py3-cassandra-medusa, airflow, kubeflow-pipelines, kserve, superset...
CVE-2026-59884 vulnerabilities
Vulnerabilities for packages: mlflow, openstack-keystone-2026.1, wazuh-manager, kubeflow-pipelines, openstack-keystone-2025.1, datahub-ingestion, py3-cassandra-medusa, wazuh-manager-fips, superset, kserve, lmcache-cuda-12.8, duplicity, authentik, airflow, apache-beam-python-3.12-sdk, dbt-bigquery...
CVE-2026-67320
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...
CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
Malicious code in test-dev-boot (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fd45eccde1d78006f2a808730aa4723756d255697ac1479d52aa7e89f792e51 On require/import and when invoked as a bin, the package's main entrypoint detects Windows and installs an...
Malicious code in test-dev-watch (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9279c0e19b9b69a299d8c88c237d4e6c215f7fe4527e8d7f9fbb049065ead5e2 The package exports a Helper class that implements two installer-harming primitives on Windows. First, start launches a polling loop that reads every...
MAL-2026-11495 Malicious code in test-dev-watch (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9279c0e19b9b69a299d8c88c237d4e6c215f7fe4527e8d7f9fbb049065ead5e2 The package exports a Helper class that implements two installer-harming primitives on Windows. First, start launches a polling loop that reads every...
SUSE CVE-2026-55244
ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROMPY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and GeneratorExit to expressions evaluated by asteval.Interpreter.eval, while run and eval in asteval/asteval.py catch Exception rather...
SUSE CVE-2026-55777
GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to 1.11, the parseios function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent...
Linux Distros Unpatched Vulnerability : CVE-2026-64607
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or...
MAL-2026-11473 Malicious code in metrics-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40a5f1c46b3dedff62a0fbbb97026f6ad0b4c59cbbfb5f3078de824328c09b8c metrics-ui is a functionally empty npm package hollow index.js, no scripts whose only effect on installers is pulling in a runtime dependency resolve...
MAL-2026-11477 Malicious code in refbase-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 745c419d7f3a6fbe38ef076e64076ca81735ccf43395f2bb6296b4d8ffca794f Package published as 'refbase-mcp' self-describes as 'install-email-research'. The postinstall hook loads lib/report.js which, when a consent flag is...
MAL-2026-11472 Malicious code in mcp-server-boilerplate (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50ee88b53e786db18609f7956c556a7f814b476c895bb90d5663aedc82ca14f0 Package name 'mcp-server-boilerplate' is unrelated to the Model Context Protocol ecosystem it evokes; the shipped code is a data-collection payload...
CVE-2026-53669 vulnerabilities
Vulnerabilities for packages: keycloak, vitess...
GHSA-94P4-4CQ8-9G67 vulnerabilities
Vulnerabilities for packages: mlflow...
GHSA-VJC4-5QP5-M44J vulnerabilities
Vulnerabilities for packages: mlflow, superset, open-webui...
GHSA-WXPP-56Q6-5PCG vulnerabilities
Vulnerabilities for packages: apache-nifi-registry, keycloak-config-cli, zipkin...