Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-006971)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006971 advisory. In the Linux kernel, the following vulnerability has been resolved: irqchip: Fix refcount leak in platformirqchipprobe ofirqfindparent returns a node pointer with...

PT-2026-36920

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.3.8 Description An authenticated user can access the 'GET /api/settings' endpoint to retrieve sensitive configuration values, such as node.secret. This secret is accepted by the AuthRequired function via the...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-013381)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013381 advisory. In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix null pointer dereferencing in ofunittestfindnodebyname when kmalloc fail to...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-011237)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011237 advisory. In the Linux kernel, the following vulnerability has been resolved: rcu: Protect rcuprinttaskexpstall -exptasks access For kernels built with CONFIGPREEMPTRCU=y, the...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011010)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011010 advisory. In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix devicenode use after free At probe time this code path is...

Embedded Malicious Code

Overview pgserve is an Embedded PostgreSQL server with true concurrent connections - zero config, auto-provision databases Affected versions of this package are vulnerable to Embedded Malicious Code that injects a credential-harvesting script that runs via postinstall on every npm install. It...

MAL-2026-2956 Malicious code in @serasa/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a5d7dc70207045632b443597fdca880203a20b38f5999520fe5c437ca65a496 The package @serasa/core was found to contain malicious code. Source: ghsa-malware a4f77a3e4a851be714d9bf54f710ffa9244ea5b12e85a1341a61802b1655acfc A...

Malicious code in @serasa/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a5d7dc70207045632b443597fdca880203a20b38f5999520fe5c437ca65a496 The package @serasa/core was found to contain malicious code. Source: ghsa-malware a4f77a3e4a851be714d9bf54f710ffa9244ea5b12e85a1341a61802b1655acfc A...

MAL-2026-2952 Malicious code in @settle-sea/supporting-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1a578c532adf03529b20a3a434751c75d17e6c7ea31e4ca1881447db490cc78 The package @settle-sea/supporting-documents was found to contain malicious code. Source: ghsa-malware...

Malicious code in @settle-sea/supporting-documents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1a578c532adf03529b20a3a434751c75d17e6c7ea31e4ca1881447db490cc78 The package @settle-sea/supporting-documents was found to contain malicious code. Source: ghsa-malware...

Malicious code in bmg-web-features (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95e385a0f1c1bcc075d39332c519b28aebc80cd8474cbc78baff5ce19661b85f The package bmg-web-features was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2953 Malicious code in bmg-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 26777925b4f8e199b125a969ad8c6f4e0ff672b87613b22ce2b67fe461ba218e The package bmg-web was found to contain malicious code. Source: ossf-package-analysis 27618387221affefb03509d50b0545c22b6d18574bc71aa6f218350ca5f152...

Malicious code in megabank-worklist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f0a379223d486978f097d6f97b1d3a1fd307bb725be56c7baa2bc8ff72d297 The package megabank-worklist was found to contain malicious code. Source: ossf-package-analysis...

MAL-2026-2955 Malicious code in megabank-worklist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 51f0a379223d486978f097d6f97b1d3a1fd307bb725be56c7baa2bc8ff72d297 The package megabank-worklist was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in internal_insights_enabled (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b767ca0c2e6450230a1b4d2bfa3f974fc6e9cac87198adb5c3084ea5f6dcd5f7 The package internalinsightsenabled was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2959 Malicious code in internal_insights_enabled (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b767ca0c2e6450230a1b4d2bfa3f974fc6e9cac87198adb5c3084ea5f6dcd5f7 The package internalinsightsenabled was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2951 Malicious code in hifromhere1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82931dc7313b2b9b93b8664655cbe445702e0fdcf1cc7e587b27758d2ef9cda1 The package hifromhere1 was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in tailwind-text-fill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe1d70f1253bacbb57d827b49a08cede06a039323a86af19cebaa08cefe2cbdd The package tailwind-text-fill was found to contain malicious code. Source: ghsa-malware...

Malicious Package

Overview tailwindthml-flips is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to multiple vulnerabilities in Node.js

Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to multiple vulnerabilities in Node.js and LangChain. CVE-2026-2359, CVE-2026-3304, CVE-2026-3520, CVE-2026-29063, CVE-2026-24001, CVE-2025-69873, CVE-2026-31808. The vulnerabilities have been addressed. Vulnerability Detail...