1009768 matches found
MAL-2026-14315 Malicious code in @httttt/mcp-demo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2914b799b1c4e540a2ff20338186041f8053fd03cc28ad544ecdb36531a33278 The package's main/bin entry contains a top-level await execAsync... that downloads a file named javaagent from...
MAL-2026-14316 Malicious code in expect-dotenv (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ffc39d28e4d33afe723182c097769f087bf528732e5468b1511bf2bff41db01e The package's main entry runs a worker that performs an HTTPS GET to https://realase-0626.vercel.app/api/v1 and passes the response's parser string...
MINI-24V5-F78R-9MRH
Bulletin has no description...
MINI-69HQ-MWG7-9WG5
Bulletin has no description...
MINI-FV73-857W-CG6F
Bulletin has no description...
MINI-9WJJ-3H3J-GCJ5
Bulletin has no description...
MINI-7M28-RCV2-8R6J
Bulletin has no description...
MINI-PWHM-5CW4-3F2V
Bulletin has no description...
MINI-JC8X-2QGG-R2PM
Bulletin has no description...
MINI-7GQR-PM5C-XP9Q
Bulletin has no description...
MINI-PJFJ-J9QV-38M8
Bulletin has no description...
MINI-8G23-P53M-H8CJ
Bulletin has no description...
MINI-V26V-XQRR-RJ53
Bulletin has no description...
MINI-6X6J-6423-9Q36
Bulletin has no description...
MINI-37JP-PR26-38P9
Bulletin has no description...
MINI-CVQ9-MGHX-M33W
Bulletin has no description...
MINI-47HJ-RCR5-XVHF
Bulletin has no description...
MINI-VG5H-4H2V-M4P4
Bulletin has no description...
MINI-89QX-XXW9-3HQR
Bulletin has no description...
MINI-9MX2-382W-M39F
Bulletin has no description...
MINI-M28R-CCJR-4RCC
Bulletin has no description...
MINI-G5FJ-5M24-479C
Bulletin has no description...
MINI-P794-9294-RGQ5
Bulletin has no description...
MINI-927C-XV35-VRX4
Bulletin has no description...
MINI-HXGP-3834-2FP8
Bulletin has no description...
MINI-HVFW-X3FJ-26P6
Bulletin has no description...
MINI-2PR2-V7PR-RCM2
Bulletin has no description...
MINI-HG7P-CXMP-WW5F
Bulletin has no description...
MINI-QVWW-C6WP-J74X
Bulletin has no description...
CGA-5R92-5XGM-8PJW
Bulletin has no description...
RLSA-2026:56973 Important: mysql:8.4 security, bug fix, and enhancement update
MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and libraries. Security Fixes: mysql: Performance Schema unspecified vulnerability CPU Jul 2026 CVE-2026-61081 mysql: Optimizer unspecified vulnerability CPU Jul 2026...
ECHO-1FCB-1955-3C69
Bulletin has no description...
MAL-2026-14308 Malicious code in libasync (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3563869a8df47e05e731eafb6ea62b3d8c60672c038444139d0ff5f8941bebcf The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...
MAL-2026-14307 Malicious code in express-route-engine (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f54041362d71f16d1ee889c3992558cec28371030eaca4a3962ac0e9e3ec55d On require/import, index.js immediately invokes an initializer that HTTP-GETs a JSON document from...
CGA-59G5-G3HR-2V33
Bulletin has no description...
CGA-HQVH-6F7P-Q95X
Bulletin has no description...
CGA-M5R4-HJ36-CMWG
Bulletin has no description...
CGA-2FJV-JW68-C4PF
Bulletin has no description...
GHSA-RGR9-R7MJ-MF6X Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root
Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms dev. No manual file upload is required. The attacker page builds the...
GHSA-8MQ9-5FW2-5RM4 Tina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)
Summary The production media handler shipped by next-tinacms-s3 createMediaHandler in packages/next-tinacms-s3/src/handlers.ts accepts an attacker-chosen ?key= query parameter and returns an AWS-signed PutObject URL whose Key is that value, with no check that the key falls under the operator's...
DEBIAN-CVE-2026-73638
Bulletin has no description...
MAL-2026-14306 Malicious code in rc4-secure (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7bcd1dcd28ea36c95e97448601f2414f34d53eabfc5452ec2471a316ebed97b The package presents itself as an RC4 encryption library but contains a hidden dropper reachable from its public API. RC4Cipher.encrypt invokes...
CGA-J3WJ-HF3P-W3XV
Bulletin has no description...
CGA-9GJH-6538-Q498
Bulletin has no description...
CGA-FQW8-V5FQ-67JR
Bulletin has no description...
GHSA-RXJR-6C9Q-H67X logto-tunnel serves files outside --experience-path via path traversal
Summary @logto/tunnel serves custom sign-in experience files from the --experience-path directory. When the tunnel service is reachable, a requester can use ../ path segments in a static asset request to read files outside that directory that the CLI process can read. Details The tunnel command...
GHSA-72X6-4J93-7W86 BuildKit has a possible runtime DoS via unbounded group parsing
Impact Maliciously crafted base image or build can cause a Denial of Service DoS condition. When creating a container from this image, memory exhaustion occurs, leading to an Out Of Memory OOM kill of the buildkitd process. Patches Issue is fixed in BuildKit v0.31.1+ Workarounds Use trusted build...
GHSA-7236-3392-C5C6 BuildKit: Custom frontend could bypass Seccomp/AppArmor
Impact A custom frontend could send a crafted build request that disabled Seccomp and AppArmor protections for the build container, even if the user did not explicitly allow the security.insecure entitlement. Other security measures, like Linux capabilities were still applied to these containers...