MAL-2026-17265 Malicious code in @hrmony/kit-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6ac778d35433101385eb57755b6079e76c7bb3dc40306218cf5b1295d5a853 The package runs credential-harvesting code both at install time and at import time. The declared preinstall hook scripts/check-setup.mjs queries the...

Malicious code in @hrmony/kit-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6ac778d35433101385eb57755b6079e76c7bb3dc40306218cf5b1295d5a853 The package runs credential-harvesting code both at install time and at import time. The declared preinstall hook scripts/check-setup.mjs queries the...

RHCOS 4 : OpenShift Container Platform 4.22.16 (RHSA-2026:71445)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:71445 advisory. - encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 - net/http: golang...

CLSA-2026-1790609840 TuxCare security update for nanoid (4 CVEs)

TuxCare rebuilt nanoid to address 4 CVEs. Fixed in 3.3.7-tuxcare.2...

CLSA-2026-1790597933 TuxCare security update for fast-xml-parser (2 CVEs)

TuxCare rebuilt fast-xml-parser to address 2 CVEs. Fixed in 4.5.1-tuxcare.4...

CLSA-2026-1790488353 TuxCare security update for @angular (4 CVEs)

TuxCare rebuilt 16 @angular packages to address 4 CVEs. Fixed in 19.2.21-tuxcare.7...

CLSA-2026-1790477639 TuxCare security update for @angular (4 CVEs)

TuxCare rebuilt 16 @angular packages to address 4 CVEs. Fixed in 18.2.12-tuxcare.6...

CLSA-2026-1790477222 TuxCare security update for @angular (4 CVEs)

TuxCare rebuilt 16 @angular packages to address 4 CVEs. Fixed in 18.1.2-tuxcare.6...

CLSA-2026-1790476096 TuxCare security update for @angular (4 CVEs)

TuxCare rebuilt 16 @angular packages to address 4 CVEs. Fixed in 16.2.12-tuxcare.14...

CLSA-2026-1790474705 TuxCare security update for @angular (4 CVEs)

TuxCare rebuilt 16 @angular packages to address 4 CVEs. Fixed in 16.2.7-tuxcare.5...

CLSA-2026-1790470455 TuxCare security update for @angular (3 CVEs)

TuxCare rebuilt 16 @angular packages to address 3 CVEs. Fixed in 15.2.1-tuxcare.4...

PT-2026-107448

TuxCare rebuilt 17 @angular packages to address 4 CVEs. Fixed in 18.2.14-tuxcare.15...

PT-2026-107446

TuxCare rebuilt 17 @angular packages to address 4 CVEs. Fixed in 17.3.12-tuxcare.16...

CLSA-2026-1790461041 TuxCare security update for 17 packages (3 CVEs)

TuxCare rebuilt 17 packages to address 3 CVEs. Fixed in 1.19.3-tuxcare.4...

CLSA-2026-1790443334 TuxCare security update for @angular (4 CVEs)

TuxCare rebuilt 16 @angular packages to address 4 CVEs. Fixed in 12.2.17-tuxcare.11...

pgAdmin 4 Output Encoding

The vulnerability of the pgAdmin 4 database management tool is related to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

pgAdmin 4 DoS

The vulnerability of the pgAdmin 4 database management tool is related to errors in processing input data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

pgAdmin 4 Output Encoding

The vulnerability of the pgAdmin 4 database management tool is related to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

RHCOS 4 : OpenShift Container Platform 4.15.69 (RHSA-2026:67856)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67856 advisory. - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 /etc/passwd Injection via HOME env CVE-2026-15809 -...

Formie: Missing authorization on sent notification resend modal exposes submission PII

Impact The control panel action formie/sent-notifications/get-resend-modal-content SentNotificationsController::actionGetResendModalContent performed only requireAcceptsJson and loaded a SentNotification by request id without permission or object-level authorization checks. Any authenticated user...