CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

3420 matches found

ATTACKERKB•added 2026/05/20 7:38 p.m.•12 views

CVE-2026-9133

Active debug code exists in the ARN resolver of amazon-mq rabbitmq-aws before version 0.2.1. A debug ARN scheme arn:aws-debug:file accepted by the PUT /api/aws/arn/validate validation endpoint might allow remote authenticated users to perform arbitrary file reads on any file accessible to the...

8.3CVSS6AI score0.00344EPSS

Exploits0References4Affected Software1

Microsoft Secure•added 2026/05/20 5:48 p.m.•17 views

Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft

In this article 1. Attack chain overview 1. Technical analysis 2. How GitHub took action to prevent further harm 2. Mitigation and protection guidance 1. Microsoft Defender XDR Detections 2. Microsoft Defender XDR Threat analytics 3. Advanced hunting 4. Indicators of Compromise IOC 3. References ...

6AI score

Exploits0

AstraLinux•added 2026/05/20 5:53 a.m.•7 views

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible’s amazon.aws collection when using the towercallback parameter from the amazon.aws.ec2instance module. This flaw allows an attacker to exploit the issue, as the module handles the parameter insecurely, resulting in the password being leaked in the logs...

7.5CVSS6.8AI score0.00712EPSS

Exploits0References2

OSSF Malicious Packages•added 2026/05/19 12:0 a.m.•19 views

Malicious code in @antv/dipper-map (npm)

Part of the Mini Shai-Hulud supply chain attack campaign in which a threat actor compromised the npm account atool and published 631 malicious versions across 314 npm packages in an automated 22-minute burst. Each malicious version injects a preinstall hook that executes a 498KB obfuscated Bun...

5.8AI score

Exploits0References4

OSSF Malicious Packages•added 2026/05/19 12:0 a.m.•26 views

Malicious code in @antv/async-hook (npm)

5.8AI score

Exploits0References5

OSSF Malicious Packages•added 2026/05/19 12:0 a.m.•13 views

Malicious code in @antv/x6-plugin-transform (npm)

5.8AI score

Exploits0References5

OSV•added 2026/05/19 12:0 a.m.•15 views

MAL-2026-3876 Malicious code in @antv/dw-random (npm)

5.8AI score

Exploits0References5

OSV•added 2026/05/19 12:0 a.m.•12 views

MAL-2026-4033 Malicious code in @antv/l7 (npm)

5.8AI score

Exploits0References5

Snyk•added 2026/05/18 9:0 p.m.•16 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

9.8CVSS5.9AI score

Exploits0References2

Krebs on Security•added 2026/05/18 8:48 p.m.•21 views

CISA Admin Leaked AWS GovCloud Keys on Github

Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency CISA maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive...

5.8AI score

Exploits0

OSV•added 2026/05/18 2:0 p.m.•10 views

CLEANSTART-2026-SW24654 Security fixes for CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283 applied in versions: 3.2.1-r0

Multiple security vulnerabilities affect the aws-load-balancer-controller package. These issues are resolved in later releases. See references for individual vulnerability details...

7.5CVSS7.4AI score0.00621EPSS

Exploits0References9