Malicious code in @agora-sdk/react-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9febb9d8dda2eea07ef909b9713ca6531c4a5b51a75fd730a312bec8d8a11135 Package is published under the '@agora-sdk' scope, strongly associated with Agora.io's real-time-communications SDKs, but its actual contents are a...

MAL-2026-4429 Malicious code in @rui.branco/sentry-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8504c65903895f53054fc6df861469ddbac73c130793bd784d47eca8ef2cd65b On every load of index.js the package's main and bin entry, the package queries GitHub for the latest commit SHA on HEAD of rui-branco/sentry-mcp and...

Malicious code in @rui.branco/sentry-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8504c65903895f53054fc6df861469ddbac73c130793bd784d47eca8ef2cd65b On every load of index.js the package's main and bin entry, the package queries GitHub for the latest commit SHA on HEAD of rui-branco/sentry-mcp and...

Nginx UI 安全漏洞

Nginx UI is a web interface for Nginx developed by Jacky. Versions of Nginx UI prior to 2.3.5 contained security vulnerabilities. These vulnerabilities stemmed from WebSocket endpoints that did not validate sources and an insecure storage of authentication tokens, which could lead to cross-site...

[SECURITY] Fedora 42 Update: openbao-2.5.2-1.fc42

Openbao secures, stores, and tightly controls access to tokens, passwords, certificates, API keys, and other secrets in modern computing. Openbao handles leasing, key revocation, key rolling, and auditing. Through a unified API, us ers can access an encrypted Key/Value store and network...

CVE-2026-33544

CVE-2026-33544 affects tinyauth: before v5.0.5, GenericOAuthService, GithubOAuthService, and GoogleOAuthService store PKCE verifiers and access tokens on shared singleton instances. A race between VerifyCode() and Userinfo() during concurrent OAuth logins can cause one user’s session to be popula...

GHSA-9Q5M-JFC4-WC92 Tinyauth has OAuth account confusion via shared mutable state on singleton service instances

Summary All three OAuth service implementations GenericOAuthService, GithubOAuthService, GoogleOAuthService store PKCE verifiers and access tokens as mutable struct fields on singleton instances shared across all concurrent requests. When two users initiate OAuth login for the same provider...

PT-2026-29659

Name of the Vulnerable Software and Affected Versions Tinyauth versions prior to 5.0.5 Description Tinyauth is an authentication and authorization server. The GenericOAuthService, GithubOAuthService, and GoogleOAuthService implementations store PKCE verifiers and access tokens as mutable struct...

openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following

A flaw was found in openCryptoki, a PKCS11 library and tooling for Linux and AIX. A token-group user can exploit a symlink-following vulnerability by planting symbolic links in group-writable token directories. When an administrator runs a PKCS11 application or administrative tool as root, it may...

PT-2026-25366

LibreChat is a ChatGPT clone with additional features. From 0.8.2 to 0.8.2-rc3, The MCP Model Context Protocol OAuth callback endpoint accepts the redirect from the identity provider and stores OAuth tokens for the user who initiated the flow, without verifying that the browser hitting the redire...

JetBrains TeamCity < 2025.11.1 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2025.11.1. It is, therefore, affected by multiple vulnerabilities as referenced in the advisory. - In JetBrains TeamCity before 2025.11.0 Excessive privileges were possible due to storing GitHub personal access token inste...

JetBrains TeamCity 安全漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides features such as continuous unit testing, code quality analysis and build issue analysis reports. A security vulnerability exists in JetBrains TeamCity...

Cleartext Storage of Sensitive Information

Overview org.jenkins-ci.main:jenkins-core is an open source automation server. Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in the storage of build authorization tokens in plain text within config.xml files. An attacker can gain unauthorized acces...

CVE-2025-62794 GitHub Workflow Updater stored the optional Github token in plaintext

GitHub Workflow Updater is a VS Code extension that automatically pins GitHub Actions to specific commits for enhanced security. Before 0.0.7, any provided Github token would be stored in plaintext in the editor configuration as json on disk, rather than through the more secure "securestorage" ap...

GitHub Workflow Updater 安全漏洞

GitHub Workflow Updater is a VS Code extension by Richard Tweed Personal Developer. A security vulnerability exists in GitHub Workflow Updater versions prior to 0.0.7, which stems from storing Github tokens in cleartext, which could lead to token disclosure...

PT-2025-43541

Name of the Vulnerable Software and Affected Versions Oxford Nanopore Technologies MinKNOW versions prior to 24.11 Description The MinKNOW software stores authentication tokens in a world-readable file within the system's temporary directory /tmp on the host machine. If a token is compromised, an...

EUVD-2019-2223

Malware in sbrugna...

EUVD-2023-0332

Malicious code in bioql PyPI...

EUVD-2025-1718

Malicious code in bioql PyPI...

The vulnerability of the Jenkins automation server plugin Xooa lies in the storage of tokens in an unencrypted form, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Jenkins automation server plugin Xooa is related to the storage of tokens in an unencrypted form in the file io.jenkins.plugins.xooa.GlobConfig.xml. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...