Malicious code in moonbit-metrics-validator (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e6bb44c25db578131ec69b1c961c22f67cabb0b81aae5fe9d4620194bf8d83cc Campaign includes a chain of dependencies that finally exfiltrate sensitive environment variables to a hardcoded GitHub repository as exfiltration target, and ...

Potential Security Misconfiguration when Using withIssuerLocation

When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder , it must configure an OAuth2TokenValidator separately, for example by calling setJwtValidator . This is easy to miss when using NimbusJwtDecoderwithIssuerLocation or...

GHSA-CQ8V-F236-94QC vulnerabilities

Vulnerabilities for packages: cargo-audit, wasmcloud, sdp-k8s-injector, parseable, pixi, efs-utils, zola, linkerd2-proxy, linkerd2, mountpoint-s3, kdash, starship, sqlx, rav1e, wadm, fish, uutils, deno, yara-x, cargo-c, zizmor, shadowsocks-rust, nushell, samply, ruff, zed, buck2, biome, netavark,...

GHSA-CQ8V-F236-94QC vulnerabilities

Vulnerabilities for packages: parseable, efs-utils, buck2, qdrant, uv, jujutsu, rye, mdbook, berg, zellij, sqlx, samply, vector, wasmtime, guestproxyagent, lychee, biome, netavark, komodo, fnm, rustup, sentry-cli, fish, zed, zola, ntpd-rs, cargo-audit, linkerd2, wizer, worktrunk, garage, deno,...

CVE-2026-32605

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.numvalidators...

Malicious code in request-easy-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59057b0a6f845ac1e8bfa571c4e26295e469abdd5c6faa2e68007ef78816ec9b request-easy-validator impersonates the popular request package cloned README, bugs URL points at github.com/request/request, source is a fork of...

MAL-2026-2798 Malicious code in request-easy-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59057b0a6f845ac1e8bfa571c4e26295e469abdd5c6faa2e68007ef78816ec9b request-easy-validator impersonates the popular request package cloned README, bugs URL points at github.com/request/request, source is a fork of...

PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code

Summary The plugin security validator in PySpector uses AST-based static analysis to prevent dangerous code from being loaded as plugins. The blocklist implemented in PluginSecurity.validateplugincode is incomplete and can be bypassed using several Python constructs that are not checked. An...

OpenClaw validateBindMounts Bypass

The vulnerability of the validateBindMounts function in the AI agent OpenClaw formerly ClawdBot or MoltBot is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a attacker to bypass existing security mechanisms...

CVE-2026-40093

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation. In 1.3.0 and earlier, block timestamp validation enforces that timestamp = parent.timestamp for non-skip blocks and timestamp == parent.timestamp + MINPRODUCERTIMEOUT for skip blocks, but there is no visible upper...

CVE-2026-32605

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.numvalidators...

EUVD-2026-22061

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.numvalidators...

CVE-2026-32605 Nimiq: Remote crash via off-by-one signer bounds check in proposal buffer

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.numvalidators...

CVE-2026-32605

The CVE concerns the Rust implementation of Nimiq PoS (nimiq/core-rs-albatross). Before version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal where signer == validators.num_validators(); the code uses ProposalSender::send with a > bound check inste...

CVE-2026-32605: Out-of-bounds Read

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.numvalidators...

PT-2026-32505

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.3.0, an untrusted peer could crash a validator by publishing a signed tendermint proposal message where signer == validators.num validators...

EUVD-2026-20588

InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PARTNAMEFORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual renderer in part/helpers.py was not updated and still uses the non-sandboxed...

MAL-2026-2526 Malicious code in request-js-validator (npm)

Copy of 'request' library with injected payload. Spawns detached child process that fetches stage-2 and executes via new Function.constructor'require', payload. Same pattern as express-session-js. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector...

Malicious code in request-js-validator (npm)

Copy of 'request' library with injected payload. Spawns detached child process that fetches stage-2 and executes via new Function.constructor'require', payload. Same pattern as express-session-js. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector...

BIT-PARSE-2026-34532 Parse Server: Cloud function validator bypass via prototype chain traversal

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.67 and 9.7.0, an attacker can bypass Cloud Function validator access controls by appending "prototype.constructor" to the function name in the URL. When a Cloud Function...