AlmaLinux 9.2 [TuxCare] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1784133121)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1784133121 advisory. - During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates a...

AlmaLinux 9.2 [TuxCare] Security Update: skopeo / skopeo-tests Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1790802024)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790802024 advisory. - Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. CVE-2026-3381...

Rocky Linux 9.6 [TuxCare] Security Update: skopeo / skopeo-tests (ALMALINUX9.6:CLSA-2026:1784190453)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784190453 advisory. - x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused...

AlmaLinux 9.6 [TuxCare] Security Update: skopeo / skopeo-tests Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772620440)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772620440 advisory. - The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters ...

Rocky Linux 9.6 [TuxCare] Security Update: buildah / buildah-tests Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790782220)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790782220 advisory. - Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

AlmaLinux 9.6 [TuxCare] Security Update: skopeo / skopeo-tests Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790801022)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790801022 advisory. - Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. CVE-2026-3381...

AlmaLinux 9.6 [TuxCare] Security Update: buildah / buildah-tests (ALMALINUX9.6:CLSA-2026:1777386823)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1777386823 advisory. - Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web...

Oracle Linux 9 : skopeo (ELSA-2026-70641)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-70641 advisory. - rebuild for CVE-2026-56853 CVE-2026-56858 CVE-2026-33818 CVE-2026-56860 CVE-2026-56862 Tenable has extracted the preceding description block directl...

Malicious code in @client-web-next/ab-tests (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-16494 Malicious code in @client-web-next/ab-tests (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious Package

Overview linkedin-tests is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

CVE-2026-54918 NetBox Device Type Library: PR-controllable upstream clone URL (NETBOX_DT_LIBRARY_URL) enables SSRF and test-data substitution from CI

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOXDTLIBRARYURL in tests/testconfiguration.py is a free-form tracked constant that an unauthenticated pull-request author can change before the...

CVE-2026-54916 NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An...

CVE-2026-54916

NetBox Device Type Library (a community-sourced collection of device type definitions for import into NetBox) is affected by a module-shadowing vulnerability (CVSS 8.8 HIGH). The absence of tests/__init__.py combined with the lack of --import-mode=importlib causes pytest's prepend import mode to ...

CVE-2026-54916 NetBox Device Type Library: Module Shadowing Bypass of prior pickle fix - RCE via missing `tests/__init__.py` + SSRF via unfixed `NETBOX_DT_LIBRARY_URL` → Cloud Metadata credential theft

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The absence of tests/init.py and the lack of --import-mode=importlib cause pytest prepend import mode to place the tests directory at the front of sys.path during collection. An...

CVE-2026-54752: Deserialization of Untrusted Data

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. The validation test harness can deserialize pull-request-controlled tracked pickle cache files through pickle.load in the readpickledata function in tests/pickleoperations.py. An...

CVE-2026-54918: External Control of System or Configuration Setting

NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. In the affected repository revisions, NETBOXDTLIBRARYURL in tests/testconfiguration.py is a free-form tracked constant that an unauthenticated pull-request author can change before the...

PT-2026-95097

Name of the Vulnerable Software and Affected Versions NetBox Device Type Library affected versions not specified Description An unauthenticated pull-request author can modify the NETBOX DT LIBRARY URL constant in tests/test configuration.py before the validation test harness executes. During pyte...

PT-2026-95096

Name of the Vulnerable Software and Affected Versions NetBox Device Type Library affected versions not specified Description An issue exists where the absence of tests/init.py and the lack of --import-mode=importlib cause pytest to place the tests directory at the front of sys.path during...

PT-2026-95095

Name of the Vulnerable Software and Affected Versions NetBox Device Type Library affected versions not specified Description The validation test harness allows the deserialization of tracked pickle cache files via the pickle.load method within the read pickle data function located in tests/pickle...