[SECURITY] Fedora 43 Update: perl-XML-Bare-0.53-44.fc43

This module is a 'Bare' XML parser. It is implemented in C. The parser itself is a simple state engine that is less than 500 lines of C. The parser builds a C struct tree from input text. That C struct tree is converted to a Perl hash by a Perl function that makes basic calls back to the C to go...

Fedora 43 : perl-XML-Bare (2026-14e358a2a2)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-14e358a2a2 advisory. XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. This packages fixes this issue. Fixes...

Fedora 44 : perl-XML-Bare (2026-5c3f4c8337)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-5c3f4c8337 advisory. XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes. This packages fixes this issue. Fixes...

tamago v1.27.1

TamaGo - bare metal Go tamago | https://github.com/usbarmory/tamago Copyright c The TamaGo Authors. All Rights Reserved. Introduction TamaGo is a framework that enables compilation and execution of unencumbered Go applications on bare metal processors. The projects spawns from the desire of...

MAL-2026-15868 Malicious code in @bx-ui-framework/microfrontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1680cbcfbae85350989b4d123a117deb73e45aad1ee7aa339cdcef34d3fbe30 package.json declares a runtime dependency microfrontend whose source is a bare HTTPS URL at...

Malicious code in @bx-ui-framework/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c5b8886bf47df30ba72e888647d651e72defd41c1172a4307c438562183d7a32 package.json declares a dependency whose key equals the package's own name @bx-ui-framework/common and whose value is a bare HTTPS URL...

Updated perl-XML-Bare packages fix security vulnerabilities

XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes...

MGASA-2026-0368 Updated perl-XML-Bare packages fix security vulnerabilities

XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes...

PT-2026-90711

XML::Bare versions through 0.53 for Perl have an unbounded character lookahead. XML::Bare versions through 0.53 for Perl will hang in an infinite loop when parsing malformed attributes...

GHSA-6HWM-XVPH-95VM NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary

Two NLTK sites executed the Graphviz dot program by bare name, so process creation resolved it via the search path — and on Windows via the current working directory — rather than a validated absolute location. An attacker who can place a file named dot where resolution looks the CWD on Windows, ...

Security update for git-lfs (important)

openSUSE Security Update: Security update for git-lfs Announcement ID: openSUSE-SU-2026:0305-1 Rating: important References: 1239322 1252259 Cross-References: CVE-2025-22869 CVE-2025-26625 CVSS scores: CVE-2025-22869 SUSE: 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N...

Malicious code in analytics-web-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b8893c0594fed4d622c0e347b4e8f899d5b00e11c15fe31e09169a9fae8e82be package.json at line 11 declares a dependency whose key equals this package's own name analytics-web-client and whose source is a bare HTTPS URL...

MAL-2026-15531 Malicious code in confluence-editor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7615f50c489336db7800ea3b79ef26a4e5af311f0484ee31871000e329c2813 package.json declares a dependency whose value is a bare HTTPS URL https://repo.securityctrl.com/confluence-editor rather than a semver range publish...

MAL-2026-15534 Malicious code in firestore-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3242d5a15b769961bcc2e6d24747a7da27e2afd293ea83e6b042eceeb4b97de2 package.json declares a single dependency whose value is a bare HTTP URL https://repo.securityctrl.com/firestore-lite rather than a registry version...

Malicious code in firestore-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3242d5a15b769961bcc2e6d24747a7da27e2afd293ea83e6b042eceeb4b97de2 package.json declares a single dependency whose value is a bare HTTP URL https://repo.securityctrl.com/firestore-lite rather than a registry version...

MAL-2026-15535 Malicious code in gridster-coords (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 245882b881fde3396fcb6e1e14f8b0014fc64cd1d02d27f101c8fd2a0b16c944 package.json line 11 declares the dependency 'gridster-coords' as the bare HTTPS URL https://repo.securityctrl.com/gridster-coords instead of a...

Malicious code in amplitude-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 489592652dd724254e29c10536019e0e03e8032e781748a73fc357bb40f50a1d package.json declares a single dependency whose source is a bare HTTPS URL https://repo.securityctrl.com/amplitude-react-native rather than a registr...

Malicious code in framework-zero (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfa0b9f3bb077648bf715ae13565ed44e67471548c98861bd5fb4d9472a3223b package.json line 11 declares a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/framework-zero instead of a registry...

Malicious code in calcite-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91223994e8bb4e46e1b3ca5eea1714a25fedbb828090590110f8c23353c6ec17 package.json at line 11 declares the package's own name as a dependency whose source is the bare URL https://repo.securityctrl.com/calcite-web instea...

Malicious code in mintel-taskbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ebda78171ac8816c0e350f84923af0bad54c075f91cfcc1a7bcc26d36674c4f package.json line 11 declares the package's own name 'mintel-taskbar' as a dependency whose source is the bare HTTPS URL...