CVE-2026-18953

Improper limitation of a pathname to a restricted directory in the getresource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To remediate this...

CVE-2026-18954 Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode...

CVE-2026-18954 Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-7869

IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API POST /api/v1/knowledgebases. This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker...

CVE-2026-70428

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system...

EUVD-2026-53571

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-70427

Jenkins versions 2.575 and earlier (including LTS 2.568.1 and earlier ) are vulnerable to a link following vulnerability during the extraction of .tar and .tar.gz archives. The root cause is the software's failure to safely handle symbolic links with effectively empty names. This allows an attack...

EUVD-2026-53570

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

Veeam Service Provider Console’s vulnerabilities

Veeam has identified several vulnerabilities in the Veeam Service Provider Console. These vulnerabilities exist in various components of the Veeam Service Provider Console. An unauthorized attacker can act as a managed agent within the system and thereby obtain the corresponding login credentials...

Malicious code in bigops-procedure-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e28923577eff8eba09d7ebbd941220727c1851cf46ef25f4de8960070ad33bb On require, index.js loads loader.js, which reconstructs delivery hostnames at runtime via array.join"" e.g. oob-worker.cf102-baf.workers.dev,...

Malicious code in bigops-products-loans (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bee9ea7bc129d916b60d18e41425309fc1191d8d7688f1536d500f455f6d4c9a On require of bigops-products-loans, index.js loads init.js which downloads a platform-specific binary from obfuscated Cloudflare Workers subdomains...

MAL-2026-13250 Malicious code in bigops-statements-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d10168eeae00c6455a6a5a4838aa1afc9460a1edbc287d0b6f8b4acab5eae316 On require of the package, index.js loads support.js which selects a platform-specific asset path and downloads a binary over HTTPS from a rotating...

MAL-2026-13267 Malicious code in devplatform-test-pvm-is-even (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4ab114c230ec1d462306a74f0eaaddf32474b1fae0087e1038ab2e280637d558 The main entry index.js requires./runtime.js, which at load time assembles hostnames from split string arrays e.g. 'oob-worker.cf101-adf.workers.dev'...

Malicious code in dolyame-boxy-atom-bnpl-dangerously-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48ce2aa10d245536ed6cfd1903fe1b553eef84d8e949b0bd1b970817b7f13e98 On require of the package, index.js loads loader.js which reconstructs attacker-controlled hostnames via string-split.join'' to evade scanners mirror...

Malicious code in dolyame-boxy-atom-bnpl-image-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 484dee0934d765de93fad820114619db6ba613ac0eae09b9b402949f116e796f The package's main entry loads setup.js, which on require fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are...

MAL-2026-13321 Malicious code in dolyame-boxy-independent-bnpl-mobile-application (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 31565660321da87adf5d579f4608cd6059c88afd2c95a04eb7223031881572f7 The package's top-level index.js unconditionally requires./platform on load. platform.js reconstructs a set of mirror hostnames via string-split...

MAL-2026-13136 Malicious code in dolyame-ui-badge (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11c1280f596630bc692c2587a15a33bd01b2b745875cfe8a590e6787757867dd On require of dolyame-ui-badge, the package loads bootstrap.js which downloads a native binary from runtime-assembled Cloudflare Workers hosts...