Popular telnyx package compromised on PyPI by TeamPCP

aikido.dev · Undated · Licence: not cleared; local research copy only

CVEs this report names

2 CVEs

CVE-2026-33634Aquasecurity Trivy Embedded Malicious Code Vulnerability
Aquasecurity · TrivyKEVPublic exploitHigh · 8.8T1195.002Compromise Software Supply Chain T1552.001Credentials In Files2 reports
59.7%Top 0.87%
80.1priority
CVE-2026-52813Gogs: Path Traversal in organization name results in RCE through Git hooks
gogs · gogsPublic exploitCritical · 10.05 reports
1.1%Top 34%
77.5priority

Aqua Security's open source vulnerability scanner was backdoored, resulting in CVE-2026-33634 (CVSS 9.4).

CVE-2026-52813 | An Aikido pentesting agent flagged a path traversal in Gogs.

None

No passage in this report has been tied to an ATT&CK technique.