Malicious code in test-react-app-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c5f625e91f5a500b87bd2e2d34c625a73bda73a3b9c2e4762b389d42d117be1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in test-react-app-out (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3dd53fc6c31b6410f38c097f6d542696fae75c2c4a4b5ed41cc2b85955042e4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16374 Malicious code in test-react-app-in (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c5f625e91f5a500b87bd2e2d34c625a73bda73a3b9c2e4762b389d42d117be1 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16375 Malicious code in test-react-app-out (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3dd53fc6c31b6410f38c097f6d542696fae75c2c4a4b5ed41cc2b85955042e4 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in test-react-app-way (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40ffd4746c324ba82849889a1bf7cda559dc5bb7c4cfb7106e98d50491b2f35b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16376 Malicious code in test-react-app-way (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40ffd4746c324ba82849889a1bf7cda559dc5bb7c4cfb7106e98d50491b2f35b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

CVE-2026-55563

Feast , an open-source feature store for AI/ML, is vulnerable in versions prior to 0.65.0 through its GitHub Actions workflow (.github/workflows/pr_integration_tests.yml). The workflow uses pull_request_target with the synchronize event and preserves approval labels (ok-to-test, approved, lgtm) a...

CVE-2026-55563 Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persistence on `synchronize`

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...

CVE-2026-55563 Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persistence on `synchronize`

Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/printegrationtests.yml uses pullrequesttarget with the synchronize event and preserves ok-to-test, approved, or lgtm labels across newly pushed commits, allowing a fork contributor to obtain...

CVE-2026-55625 GoCD is vulnerable to authorization bypass via material connection test APIs

GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/materialtest and /go/api/internal/configrepos//materialtest accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipelin...

CVE-2026-55625 GoCD is vulnerable to authorization bypass via material connection test APIs

GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/materialtest and /go/api/internal/configrepos//materialtest accept an arbitrary existing pipeline and pipeline-group context without sufficient validation. A pipelin...

CVE-2026-55473: Server-Side Request Forgery (SSRF)

HomeBox is a home inventory and organization system. Prior to 0.26.0, the default-on BlockBogonNets and BlockCloudMetadata notifier SSRF protections in backend/internal/sys/validate/notifierurl.go do not inspect IPv4 destinations embedded in the NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48. An...

PT-2026-96134

Name of the Vulnerable Software and Affected Versions GoCD versions 16.1.0 through 26.0.0 Description Internal material connection test APIs at '/go/api/admin/internal/material test' and '/go/api/internal/config repos//material test' accept an arbitrary existing pipeline and pipeline-group contex...

MAL-2026-16267 Malicious code in pyjstat-smooth (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f65efaaf25b41d789624595550d966762b21747205b23f15325db2e05924387d The package advertised as a JSON-stat library ships a test module that, when the test suite is executed, walks the /app and /Users directory trees,...

CVE-2026-54918

NetBox Device Type Library is a community-sourced collection of device type definitions for import into NetBox. In affected revisions, the NETBOX_DT_LIBRARY_URL constant in tests/test_configuration.py is a free-form tracked value that an unauthenticated pull-request author can modify before the C...

CVE-2026-54918 NetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CI

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOXDTLIBRARYURL in tests/testconfiguration.py is a free-form tracked constant that an unauthenticated pull-request author can change before the...

Malicious code in kartyk-github-oidc-test-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c0bc4570b5c41bc6a589bf16daea1a90f52e57b878fe6219afb1102ec24c535 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in praetorian-mind-rce-test-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7a16a607fd396ce7218fb45728cb3ca55f541326c83a063668a7a170b46acc1 At pip install time, setup.py calls a phonehome routine at module top-level before setup runs. The routine collects extensive host and container...

MAL-2026-16240 Malicious code in praetorian-mind-rce-test-2026 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7a16a607fd396ce7218fb45728cb3ca55f541326c83a063668a7a170b46acc1 At pip install time, setup.py calls a phonehome routine at module top-level before setup runs. The routine collects extensive host and container...

Vulnerabilities in Oracle Database Products

Oracle has identified 16 vulnerabilities in various Database products, including Database Server, Autonomous Health Framework, and Application Testing Suite. These vulnerabilities concern various security issues in Oracle products, including possibilities for unauthorized and low-privilege...