111114 matches found
Malicious code in dbconnectify (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6a41259fb0099de58bc669907fa6fb20331d794b13008df0afb42893808e4ab The package exposes a method queryDBConnect that base64-decodes a hardcoded URL HASHKEY → https://api.jsonbin.io/v3/b/6a609e63f5f4af5e29b05907,...
Malicious code in eslintcmd (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cf4500fbbfc85f42275772210ace6efb69c5f90d9d0a5edd7c0c75fa271f0c3 The package's postinstall script scripts/install-check.cjs fetches a JSON config from https://slimopump.vercel.app/config/clob-math.json, downloads...
CVE-2026-15583 SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header
A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud...
CVE-2026-15583
Grafana MCP Server is affected by CVE-2026-15583, a confusion-deputy vulnerability that allows an unauthenticated remote attacker to exfiltrate the server’s Grafana service-account token and perform SSRF via a crafted X-Grafana-URL header. The flaw enables targeting internal services, including c...
CVE-2026-35152
creationtimestamp| type| source ---|---|--- 2026-07-15 06:55:57+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqo5cffab52h 2026-07-15 13:12:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqoseeru4y2c 2026-07-16 10:37:06+00:00| seen|...
SUSE CVE-2026-59083
Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0...
CVE-2026-8920
creationtimestamp| type| source ---|---|--- 2026-07-15 04:19:37+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnukuc5ul22 2026-07-15 16:45:06+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1 2026-07-27 21:09:32+00:00| seen|...
CVE-2026-15029
creationtimestamp| type| source ---|---|--- 2026-07-15 04:09:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqntywrdti2u 2026-07-15 16:45:15+00:00| seen| https://www.acn.gov.it/portale/w/risolte-vulnerabilita-in-prodotti-asus-1 2026-07-27 21:40:21+00:00| seen|...
Malicious code in core-dotenv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aad83962ee4db02c1bf43558ed5fe6bf79f66754b070415223d29643a8ff754e core-dotenv presents itself as a dotenv/env-var wrapper. On calling the package's config or get, which lazily invokes config, a worker plugin.worker....
MAL-2026-10631 Malicious code in core-dotenv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aad83962ee4db02c1bf43558ed5fe6bf79f66754b070415223d29643a8ff754e core-dotenv presents itself as a dotenv/env-var wrapper. On calling the package's config or get, which lazily invokes config, a worker plugin.worker....
CVE-2026-15030
creationtimestamp| type| source ---|---|--- 2026-07-15 03:54:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnt62ow2c22 2026-07-27 21:25:02+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrnthhrsve2a 2026-07-27 21:39:56+00:00| seen|...
MAL-2026-10630 Malicious code in chai-as-byte (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a6820ba756fd8d2eb81435c478feb269e34f2aea859e42b42861d0a28f914a1f On require of the package's main entry, index.js detaches a child process that runs lib/initializeCaller.js. That script posts the caller's entire...
EUVD-2026-44515
A weakness has been identified in mastergo-design mastergo-magic-mcp up to 0.2.0. Impacted is the function z.string of the file src/tools/get-component-link.ts of the component mcpgetComponentLink. Executing a manipulation of the argument url can lead to server-side request forgery. The attack ma...
CVE-2026-15752
creationtimestamp| type| source ---|---|--- 2026-07-15 00:09:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqngmfzazt24 2026-07-27 08:46:55+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmj3u7hwj23 2026-07-27 08:47:41+00:00| seen|...
CVE-2026-5270
creationtimestamp| type| source ---|---|--- 2026-07-15 00:04:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqngczzwyz2x 2026-07-15 13:38:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqotriltvq2p 2026-07-27 09:08:14+00:00| seen|...
PT-2026-58884
Name of the Vulnerable Software and Affected Versions Grafana MCP Server affected versions not specified Description A confused-deputy flaw allows an unauthenticated remote attacker to exfiltrate the environment-configured Grafana service-account token. This is achieved by supplying a crafted...
PT-2026-60384
Name of the Vulnerable Software and Affected Versions Koel versions prior to 9.7.0 Description An authenticated user can trigger server-side requests to internal destinations, such as loopback, Docker bridge, or RFC1918 HTTP addresses, because the Subsonic-compatible createPodcastChannel.view...
RHEL 9 : Red Hat OpenStack Services on OpenShift 18.0 (golang-github-openstack-k8s-operators-os-diff) (RHSA-2026:39810)
The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:39810 advisory. Security Fixes: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-61726 golang: Denial of Service due to excessive...
CVE-2026-36035
creationtimestamp| type| source ---|---|--- 2026-07-14 23:54:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqnfqvwm4q27 2026-07-27 09:05:47+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mrmk5mowaa27...