42474 matches found
MAL-2026-11485 Malicious code in simple-date-formatter-util-2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2102f256bd17b2a80b2157371bee5a3cc1d9c49484aaef694a094218c2a7bac The package.json postinstall script runs on every npm install and uses curl to probe cloud instance-metadata services AWS 169.254.169.254, Alibaba...
Malicious code in simple-date-formatter-util-1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f633eec2e322fce0493ff996493eebe8036c628be4ab0caf4844928d6ccdf10f Package advertises itself as a date formatting utility but ships an active install-time exfiltration payload. package.json declares a postinstall hoo...
GHSA-88FW-V6X4-3F58 vulnerabilities
Vulnerabilities for packages: camunda-zeebe, apache-nifi-registry...
GHSA-M4P7-R5RC-7G4J vulnerabilities
Vulnerabilities for packages: superset, airflow, kubeflow-pipelines, kserve, mlflow, py3-cassandra-medusa...
CVE-2026-59884 vulnerabilities
Vulnerabilities for packages: authentik, lmcache-cuda-12.8, openstack-keystone-2026.1, apache-beam-python-3.12-sdk, superset, wazuh-manager-fips, kserve, localstack, openstack-keystone-2025.2, kubeflow-pipelines, dbt-bigquery, datahub-ingestion, wazuh-manager, authentik-fips, mlflow,...
CVE-2026-67320
axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...
CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
Malicious code in test-dev-boot (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fd45eccde1d78006f2a808730aa4723756d255697ac1479d52aa7e89f792e51 On require/import and when invoked as a bin, the package's main entrypoint detects Windows and installs an...
MAL-2026-11495 Malicious code in test-dev-watch (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9279c0e19b9b69a299d8c88c237d4e6c215f7fe4527e8d7f9fbb049065ead5e2 The package exports a Helper class that implements two installer-harming primitives on Windows. First, start launches a polling loop that reads every...
Malicious code in test-dev-watch (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9279c0e19b9b69a299d8c88c237d4e6c215f7fe4527e8d7f9fbb049065ead5e2 The package exports a Helper class that implements two installer-harming primitives on Windows. First, start launches a polling loop that reads every...
SUSE CVE-2026-55244
unknown...
Linux Distros Unpatched Vulnerability : CVE-2026-64607
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or...
MAL-2026-11473 Malicious code in metrics-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40a5f1c46b3dedff62a0fbbb97026f6ad0b4c59cbbfb5f3078de824328c09b8c metrics-ui is a functionally empty npm package hollow index.js, no scripts whose only effect on installers is pulling in a runtime dependency resolve...
MAL-2026-11477 Malicious code in refbase-mcp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 745c419d7f3a6fbe38ef076e64076ca81735ccf43395f2bb6296b4d8ffca794f Package published as 'refbase-mcp' self-describes as 'install-email-research'. The postinstall hook loads lib/report.js which, when a consent flag is...
MAL-2026-11472 Malicious code in mcp-server-boilerplate (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50ee88b53e786db18609f7956c556a7f814b476c895bb90d5663aedc82ca14f0 Package name 'mcp-server-boilerplate' is unrelated to the Model Context Protocol ecosystem it evokes; the shipped code is a data-collection payload...
CVE-2026-53669 vulnerabilities
Vulnerabilities for packages: vitess, keycloak...
GHSA-94P4-4CQ8-9G67 vulnerabilities
Vulnerabilities for packages: mlflow...
GHSA-VJC4-5QP5-M44J vulnerabilities
Vulnerabilities for packages: open-webui, mlflow, superset...