Oracle Linux 9 : maven:3.9 (ELSA-2026-38500)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-38500 advisory. aopalliance 0:1.0-49 - Update javapackages test plan to f42 0:1.0-40 - Rebuilt for https://fedoraproject.org/wiki/Fedora41MassRebuild 0:1.0-39 - Rebuilt for...

maven:3.8 security update

An update is available for module.slf4j, module.cdi-api, atinject, maven-resolver, module.maven, module.maven-wagon, slf4j, module.apache-commons-cli, plexus-utils, module.sisu, module.plexus-classworlds, apache-commons-io, module.plexus-sec-dispatcher, module.apache-commons-lang3,...

org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method

A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the extractFile method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user...

Important: Red Hat Security Advisory: maven:3.8 security update

An update for the maven:3.8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

In this article 1. Attack chain overview 2. How the attack started: GitHub Actions pwn request 3. Mitigation and protection guidance 4. Learn more On July 14, 2026, Microsoft Threat Intelligence identified a coordinated supply chain compromise of the @asyncapi npm organization, a widely used set ...

Unpacking the AsyncAPI npm supply chain compromise and import-time payload delivery

In this article 1. Attack chain overview 2. How the attack started: GitHub Actions pwn request 3. Mitigation and protection guidance 4. Learn more On July 14, 2026, Microsoft Threat Intelligence identified a coordinated supply chain compromise of the @asyncapi npm organization, a widely used set ...

RHEL 8 : maven:3.8 (RHSA-2026:40841)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:40841 advisory. Maven is a software project management and comprehension tool. Based on the concept of a project object model POM, Maven can manage a project's buil...

RockyLinux 8 : maven:3.8 (RLSA-2026:40841)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:40841 advisory. org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2025-67030 Tenable has extracted the preceding description block...

SUSE SLED15: glibc / glibc-32bit / glibc-devel / glibc-devel-32bit / etc (SUSE-SU-2026:3030-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3030-1 advisory. This update for glibc fixes the following issues - CVE-2026-5435: unchecked buffer writing in TSIG handling ca...

MiracleLinux 8 : perl:5.32 (AXSA:2026-1273:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1273:01 advisory. perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access CVE-2026-42496 perl-IO-Compress:...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: perl: perl-5.42.2-524.3.hum1 aarch64, x8664 perl-Attribute-Handlers-1.03-524.3.hum1 noarch perl-AutoLoader-5.74-524.3.hum1 noarch perl-AutoSplit-5.74-524.3.hum1 noarch perl-B-1.89-524.3.hum1...

Malicious code in commonjs-assert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7fa2454998144bffed3fc1e2d73046b8414179b59fb99d3339f2658e00637f7 The package name resembles Node.js's built-in assert module. On require, index.js spawns a detached node child process against...

MAL-2026-10676 Malicious code in commonjs-assert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7fa2454998144bffed3fc1e2d73046b8414179b59fb99d3339f2658e00637f7 The package name resembles Node.js's built-in assert module. On require, index.js spawns a detached node child process against...

Security update for glibc

This update for glibc fixes the following issues CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write bsc1263656. CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure bsc1263658. Patch...

cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall

A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this by using a crafted requestkey payload to trick the root-own...

cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall

A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled environment. A local, low privileged attacker can exploit this by using a crafted requestkey payload to trick the root-own...

glibc security update

2.39-121.0.1 - Forward port Oracle changes to 2.39-121. - Reviewed-by: David Faust Oracle history: April-2-2026 Cupertino Miranda - 2.39-113.0.1 - Reverted to version 2.39-113. - Reviewed-by: David Faust February-3-2026 Cupertino Miranda - 2.39-99.0.1 - Forward port Oracle changes to 2.39-99. -...

maven:3.9 security update

aopalliance 0:1.0-49 - Update javapackages test plan to f42 0:1.0-40 - Rebuilt for https://fedoraproject.org/wiki/Fedora41MassRebuild 0:1.0-39 - Rebuilt for java-21-openjdk as system jdk 0:1.0-38 - bump of release for for java-21-openjdk as system jdk 0:1.0-37 - Rebuilt for...

Malicious code in assertion-utils-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 311d22d9694863456136cf4f8b69a291fdbb631eda56bafca1959e0c184774a1 assertion-utils-js is a typosquat of chai name, description, and keywords mirror the real package. On require, index.js spawns a detached Node child...

MAL-2026-10612 Malicious code in assertion-utils-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 311d22d9694863456136cf4f8b69a291fdbb631eda56bafca1959e0c184774a1 assertion-utils-js is a typosquat of chai name, description, and keywords mirror the real package. On require, index.js spawns a detached Node child...