MAL-2026-7387 Malicious code in resource-library-engine (npm)

--- -= Per source details. Do not edit below this line.=-...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2024-3568 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2024-3568 Source advisory: OSV:PYSEC-2026-1978...

aie-sdk (>=3.0.1, <=3.0.4), aiearth-engine (>=3.0.2, <=3.1.6) +115 more potentially affected by CVE-2023-50782 via cryptography (38.0.1)

cryptography PYPI version 38.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - aie-sdk =3.0.1, =3.0.2, =2022.10.0b0, =3.0.0, =2.1.1, =0.1.37, =0.7.18, =0.1.9, =0.1.10 - c7n-org 0.6.18 and more Source cves:...

aie-sdk (>=3.0.1, <=3.0.4), aiearth-engine (>=3.0.2, <=3.1.6) +115 more potentially affected by CVE-2024-0727 via cryptography (38.0.1)

cryptography PYPI version 38.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - aie-sdk =3.0.1, =3.0.2, =2022.10.0b0, =3.0.0, =2.1.1, =0.1.37, =0.7.18, =0.1.9, =0.1.10 - c7n-org 0.6.18 and more Source cves:...

autopilotml (>=1.0.1, <=1.0.14), chicken-coop (>=0.0.1, <=0.0.5) +11 more potentially affected by CVE-2024-22415 via jupyter-lsp (>=2.2.0, <=2.2.1)

jupyter-lsp PYPI version =2.2.0, =1.0.1, =0.0.1, =0.0.1, =1.16.0, =0.0.1, =0.82.0, =1.0.4, =0.0.2, =0.0.12 Source cves: CVE-2024-22415 Source advisory: OSV:PYSEC-2026-1478...

intelligenzaartificiale (>=0.0.0.35, <=0.0.0.38), trt-engine-explorer (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-21642 via dtale (2.2.0)

dtale PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - intelligenzaartificiale =0.0.0.35, =0.1.0, =0.1.1 Source cves: CVE-2024-21642 Source advisory: OSV:PYSEC-2026-1319...

trt-engine-explorer (>=0.1.2, <=0.1.5) potentially affected by CVE-2024-21642 via dtale (2.16.0)

dtale PYPI version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - trt-engine-explorer =0.1.2, =0.1.5 Source cves: CVE-2024-21642 Source advisory: OSV:PYSEC-2026-1319...

trt-engine-explorer (>=0.1.2, <=0.1.5) potentially affected by CVE-2023-46134 via dtale (2.16.0)

dtale PYPI version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - trt-engine-explorer =0.1.2, =0.1.5 Source cves: CVE-2023-46134 Source advisory: OSV:PYSEC-2026-1322...

intelligenzaartificiale (>=0.0.0.35, <=0.0.0.38), trt-engine-explorer (>=0.1.0, <=0.1.1) potentially affected by CVE-2023-46134 via dtale (2.2.0)

dtale PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - intelligenzaartificiale =0.0.0.35, =0.1.0, =0.1.1 Source cves: CVE-2023-46134 Source advisory: OSV:PYSEC-2026-1322...

Important: Red Hat Security Advisory: Assisted Installer RHEL 9 components for Multicluster Engine for Kubernetes 2.6.12

Assisted installer RHEL 9 components for the multicluster engine for Kubernetes 2.6.12 General Availability release, with updates to container images. Assisted Installer RHEL 9 integrates components for the general multicluster engine for Kubernetes 2.6.12 release that simplify the process of...

onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds

...

Important: Red Hat Security Advisory: Assisted Installer RHEL 8 components for Multicluster Engine for Kubernetes 2.6.12

Assisted installer RHEL 8 components for the multicluster engine for Kubernetes 2.6.12 General Availability release, with updates to container images. Assisted Installer RHEL 8 integrates components for the general multicluster engine for Kubernetes 2.6.12 release that simplify the process of...

CVE-2026-10834

The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their...

CVE-2026-10834

The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their...

CVE-2026-10834 WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image

The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their...

CVE-2026-10834 WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image

The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their...

CVE-2026-10834

The WP Travel Engine WordPress plugin (versions prior to 6.8.1 ) is vulnerable to an arbitrary file move issue because it fails to properly validate the source of a user-supplied profile image path before moving the file. Authenticated users with subscriber-level access and above can exploit this...

EUVD-2026-42010

The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their...

SUSE CVE-2026-13967

Heap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2026-14383

Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: Medium...