MAL-2026-15562 Malicious code in test-in-one (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4834c80d92d51ee12f73395ddc87c681baf4f911c6bbec54a9110cc55a9c4ae9 The package declares a local file: dependency detector at file:.yalc/detector whose postinstall script src/scripts/check.js executes automatically on...

CVE-2026-82262

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

SUSE CVE-2026-80639

In the Linux kernel, the following vulnerability has been resolved: cxl/test: Fix fortifypanic Fix a runtime assertion in setupxormapping. Fortify complains that it is potentially overflowing the xormaps array per countedbynrmaps. Quiet the false positive by initializing @nrmaps earlier. memcpy:...

CVE-2026-82262 Logto Server-Side Request Forgery via webhook test endpoint

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

CVE-2026-82262

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

CVE-2026-82262

Logto through 1.42.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the POST /api/hooks/:id/test endpoint. The endpoint accepts arbitrary URLs without host validation, allowing tenant administrators holding Management API tokens to issue HTTP POST requests to internal services on ...

CVE-2026-82262 Logto Server-Side Request Forgery via webhook test endpoint

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

CVE-2026-82262 Logto Server-Side Request Forgery via webhook test endpoint

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

EUVD-2026-67793

Logto through 1.42.0 contains a server-side request forgery vulnerability in the POST /api/hooks/:id/test endpoint that accepts arbitrary URLs without host validation. Tenant administrators with Management API tokens can make the server issue HTTP POST requests to internal URLs and retrieve...

MAL-2026-15361 Malicious code in secure-test-browser-ig1r2teb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 872d4c4e38285c56113d7e681ce70c1a9cfbe69f9297ecab60387b6db8b526be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15286 Malicious code in secure-test-browser-4kquugfg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 267296c85db061ed9eb03ab46b3d2609ac8f3672f2e2b1000eb5c4128c182523 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-3a1zujw0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5eafb9932b14de66aa15f9850f0b8ef19f5964c521886d08812c9d883f68016f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-fmbp7grs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b32906cd1ade3459db84948bdf7e7dd0923b56faa35cc21d723d54bc5b15fa5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-nxottb5j (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29a89a6eb548cd54a4b641ba83437462950bb294ae1dd7faed2256b82dc79806 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-ig1r2teb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 872d4c4e38285c56113d7e681ce70c1a9cfbe69f9297ecab60387b6db8b526be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15343 Malicious code in secure-test-browser-fmbp7grs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b32906cd1ade3459db84948bdf7e7dd0923b56faa35cc21d723d54bc5b15fa5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15439 Malicious code in secure-test-browser-uoi8lnoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29289d1dea367f04f88785604a76287f26d3cc388d441947f25ba57032c5a43c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-bph71q7u (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ba1ffa1c0eaf6f918e2b77fd4ae5eacf0b90084f53d0024f671079e03479197 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-uoi8lnoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 29289d1dea367f04f88785604a76287f26d3cc388d441947f25ba57032c5a43c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-test-browser-2o7y1f6z (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware faa90dad13634f3249de9e8074837d41b4ab76babbdd2f51a3d27dc70786b9e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...