PT-2026-83867

Name of the Vulnerable Software and Affected Versions QD versions 20220208 through 20250803 Description An unauthenticated remote attacker can perform a Server-side request forgery SSRF via the '/har/test' endpoint. The Fetcher.build request function in libs/fetcher.py creates an...

EUVD-2026-68648

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication,...

Beyond the Payload: How User Invocation Shapes Coding Agent Vulnerability to Repository Poisoning

Coding agents are increasingly used for software engineering tasks, including bootstrapping projects from third-party repositories whose integrity cannot be assumed. Prior work on repository poisoning largely focuses on attacker-controlled injection and disguise, but developers also shape risk...

Linux Distros Unpatched Vulnerability : CVE-2026-80639

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: cxl/test: Fix fortifypanic Fix a runtime assertion in setupxormapping. Fortify complains tha...

Linux Distros Unpatched Vulnerability : CVE-2026-80606

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/xe/userptr: Hold notifierlock for write on inject test path When...

Malicious Package

Overview test-in-one is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview discord-mfa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

MAL-2026-15562 Malicious code in test-in-one (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4834c80d92d51ee12f73395ddc87c681baf4f911c6bbec54a9110cc55a9c4ae9 The package declares a local file: dependency detector at file:.yalc/detector whose postinstall script src/scripts/check.js executes automatically on...

Malicious code in test-in-one (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4834c80d92d51ee12f73395ddc87c681baf4f911c6bbec54a9110cc55a9c4ae9 The package declares a local file: dependency detector at file:.yalc/detector whose postinstall script src/scripts/check.js executes automatically on...

CVE-2026-82262

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

SUSE CVE-2026-80639

In the Linux kernel, the following vulnerability has been resolved: cxl/test: Fix fortifypanic Fix a runtime assertion in setupxormapping. Fortify complains that it is potentially overflowing the xormaps array per countedbynrmaps. Quiet the false positive by initializing @nrmaps earlier. memcpy:...

EUVD-2026-67793

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

CVE-2026-82262

Logto through 1.42.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the POST /api/hooks/:id/test endpoint. The endpoint accepts arbitrary URLs without host validation, allowing tenant administrators holding Management API tokens to issue HTTP POST requests to internal services on ...

CVE-2026-82262 Logto Server-Side Request Forgery via webhook test endpoint

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

CVE-2026-82262

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

CVE-2026-82262 Logto Server-Side Request Forgery via webhook test endpoint

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

CVE-2026-82262 Logto Server-Side Request Forgery via webhook test endpoint

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

Malicious code in secure-test-browser-fmbp7grs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b32906cd1ade3459db84948bdf7e7dd0923b56faa35cc21d723d54bc5b15fa5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15278 Malicious code in secure-test-browser-3a1zujw0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5eafb9932b14de66aa15f9850f0b8ef19f5964c521886d08812c9d883f68016f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-bph71q7u (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ba1ffa1c0eaf6f918e2b77fd4ae5eacf0b90084f53d0024f671079e03479197 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...