CLSA-2026-1791973636 webkit2gtk3: Fix of 62 CVEs

Rebase to webkitgtk 2.54.0 WebKitGTK Security Advisory WSA-2026-0006, aligning with the release RHEL 9 ships webkit2gtk3-2.54.0-1.el98, RHSA-2026:69098. - Adopt the CentOS Stream 9 2.54.0 packaging patch set; skia-s390x.patch and mimalloc.patch are new there for 2.54.0, fix-eclipse.patch is from...

Malicious code in linear_gorilla_cyan-62 (npm)

Source: amazon-inspector d4fb54fe60ecc7e1369fce16747a2847ec7c33ec12324e45a00b614a0b1d0445 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kentung-62 (npm)

Source: amazon-inspector af40890f1f37237f0fe91d54f6dd7cde7a9a52130fce765c71831023b555393c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in intan-62 (npm)

Source: amazon-inspector bd2f9857f9f6ca01ce21dd828e0477acf8af667d8f3b7c50dbbde80e9c0baeed This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in identical_mouse_aquamarine-62 (npm)

Source: amazon-inspector 15f34e1839de47ab896545531fa6820e8510d3fd04d005b3719a88b93ac79475 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in icha-62 (npm)

Source: amazon-inspector 2617b3a94f4efd2ab42771292d34e8ec68171c31473d5205f2f3554c80c9ff71 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in developed_swordfish_green-62 (npm)

Source: amazon-inspector 82ed70876e0fb294c51323e1ca423a719a4c9ca6804f2f0b99cdde6d852d649d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in creative_boa_jade-62 (npm)

Source: amazon-inspector 89f27095f55d5f6879dcbebf5a717faafdbd92bcc4af9d257d94c6f113f4907b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in closed_swift_indigo-62 (npm)

Source: amazon-inspector 04094aa18e5af564aca6bad01d7cdc7600d493c5235d5688aea7191845503c2d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in civil_leech_copper-62 (npm)

Source: amazon-inspector f79ac2460112aab975c4e8bf20f7e0112df23f4df71b5747789dca7fae34f702 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in cinta-62 (npm)

Source: amazon-inspector 5bcd636a261d212129275a49dd602623d45fbb31d2ba96313b1b23015e6234b6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in assistant_catshark_azure-62 (npm)

Source: amazon-inspector c6ee3f1c98f366621f14dd6f278e4b433e1437c6b162e441cc197dd91dc9ac20 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in aril-62 (npm)

Source: amazon-inspector db1546b067c19f14ae96cac27fbd04209781b32c2db334eb6e13d74dc2caf6ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in architectural_shrew_red-62 (npm)

Source: amazon-inspector c9089ef7d25604d035d061a42ec826101f01030719ba2e40cff1c5a4dce90eac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in alvira-62 (npm)

Source: amazon-inspector b5179dac34e3616ea6c5a3731a5b54e9ab4460a81546c30465658f2e4470c8d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in alvino-62 (npm)

Source: amazon-inspector 6287610bb2197273311326c2d681c944c2ea76fbf15f0eebeec07c9bd5ad2615 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious Package

Overview aril-62 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

PT-2026-83911

TuxCare rebuilt 47 io.netty packages to address 62 CVEs. Fixed in 4.1.111.Final-tuxcare.1...

BIT-KIBANA-2026-72658 Cross-Site Request Forgery in Kibana Leading to Privilege Escalation

Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...

BIT-ELK-2026-72658 Cross-Site Request Forgery in Kibana Leading to Privilege Escalation

Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when it is opened by another user, causes authenticated requests to be issu...