PT-2026-80575

Add basic validation for content proxied by the css proxy Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is local url check Fix remote content blocking bypass via unclosed url in...

ALSA-2026:54571 Important: dracut security update

The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...

ALSA-2026:54575 Important: dracut security update

The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...

ALSA-2026:54576 Important: dracut security update

The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...

CVE-2026-73648: Improper Neutralization of Input During Web Page Generation

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...

PT-2026-71786

Improper Control of Generation of Code 'Code Injection' CWE-94 in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection CAPEC-242. Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later...

Important: dracut security update

The dracut packages contain an event-driven initial RAM file system initramfs generator infrastructure based on the udev device manager. The virtual file system, initramfs, is loaded together with the kernel at boot time and initializes the system, so it can read and boot from the root partition...

SUSE SLES15 Security Update : dracut (SUSE-SU-2026:3599-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3599-1 advisory. This update for dracut fixes the following issue: Update to version 055+suse.367.g85633e8. Securitys issue fixed: - CVE-2026-15816: root cod...

CVE-2026-73422

creationtimestamp| type| source ---|---|--- 2026-08-12 22:35:16+00:00| published-proof-of-concept| https://github.com/withastro/astro/security/advisories/GHSA-4g3v-8h47-v7g6...

CVE-2026-18099 IBM i is Affected By Multiple Vulnerabilities in Navigator for i

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input...

CVE-2026-18099

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input...

Malicious code in bb-twl-k7x2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b2b4bfa3f9a02df25578aba0d7e80cb0a8daa3c357faca80c11bde6ebf670f8 The package's install and postinstall lifecycle scripts canary.js run unconditionally on npm install and collect installer-side reconnaissance:...

MAL-2026-13920 Malicious code in bb-twl-k7x2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b2b4bfa3f9a02df25578aba0d7e80cb0a8daa3c357faca80c11bde6ebf670f8 The package's install and postinstall lifecycle scripts canary.js run unconditionally on npm install and collect installer-side reconnaissance:...

Malicious code in @years20/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55ed8dc4c0467877e129dc4b2035e154dc4fec24bfda412d649fa02ed7150133 On npm install, the package's postinstall script duplicated in the main module executes shell commands to collect host identity id, hostname, pwd,...

MAL-2026-13916 Malicious code in @years20/n8n-nodes-utils-helper-g (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55ed8dc4c0467877e129dc4b2035e154dc4fec24bfda412d649fa02ed7150133 On npm install, the package's postinstall script duplicated in the main module executes shell commands to collect host identity id, hostname, pwd,...

Malicious code in @years20/n8n-nodes-utils-helper-i (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7af79542abe3fa9739f9698f2af66524a43d1c7d13e3c4bd1a77108f73caf30 The package presents itself as an n8n helper node but ships only a stub node nodes/PwnNode.node.js and a postinstall script callback.js, duplicated a...

MAL-2026-13918 Malicious code in @years20/n8n-nodes-utils-helper-i (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a7af79542abe3fa9739f9698f2af66524a43d1c7d13e3c4bd1a77108f73caf30 The package presents itself as an n8n helper node but ships only a stub node nodes/PwnNode.node.js and a postinstall script callback.js, duplicated a...

Malicious code in @years20/n8n-nodes-utils-helper-j (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae821bd0afd5bdf483830eddac1c875d1ec3d229ca2078aa4fe7d88e9573eefb @years20/n8n-nodes-utils-helper-j 1.0.0 runs a postinstall script index.js/callback.js that executes id and hostname on the installer host,...

MAL-2026-13919 Malicious code in @years20/n8n-nodes-utils-helper-j (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae821bd0afd5bdf483830eddac1c875d1ec3d229ca2078aa4fe7d88e9573eefb @years20/n8n-nodes-utils-helper-j 1.0.0 runs a postinstall script index.js/callback.js that executes id and hostname on the installer host,...

Malicious code in @years20/n8n-nodes-utils-helper-h (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96661ee04dc82c36bfa5683fc33f6d7a29d10d1e1bc21ece83ea4189dcf33ef3 Package presents itself as an n8n community utility node but ships only a 213-byte no-op node file nodes/PwnNode.node.js, self-labeled 'Pwn'. The rea...