core

OPNsense GUI и управление системой Проект OPNsense приглашает разработчиков начать вносить вклад в кодовую базу. Для своих собственных целей или — что ещё лучше — присоединиться к нам в создании лучшего open source межсетевого экрана. Процесс сборки спроектирован так, чтобы любому было легко...

CVE-2018-11235

CVE-2018-11235...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: wildfly-build-tools (UTSA-2026-022372)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-022372 advisory. Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: wildfly-build-tools (UTSA-2026-022370)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-022370 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

GO-2025-3830 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector, agentbeat-fips, cadvisor, cadvisor-fips, trufflehog-fips, prometheus-fips, trufflehog, syft-fips, tw, opentelemetry-collector-fips, apko, k9s, grype, aws-otel-collector, zot, wolfictl, dagger, buildah, buildkitd-fips,...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: flux-source-controller, zot, melange, zarf, wolfictl, falcoctl, vexctl, goreleaser, spire-server, skaffold, neuvector-sigstore-interface, tekton-chains, ko, apko, policy-controller, slsa-verifier, kubescape, aactl, tkn, gitsign...

@angular-architects/build-angular (16.2.0-next.2), @angular-builders/custom-esbuild (>=17.1.0-beta.0, <=19.1.0) +165 more potentially affected by CVE-2026-55388 via piscina (>=4.0.0, <=4.9.2)

piscina NPM version =4.0.0, =17.1.0-beta.0, =16.0.0-beta.0, =18.2.6-RC-1, =16.0.0, =16.2.0-next.0, =18.0.0-next.3, =2.2.7-bb.6, =2.1.5, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.17-dev.23 and more Source cves: CVE-2026-55388 Source advisory: SNYK:JS-PISCINA-17817071...

MAL-2026-5461 Malicious code in fhirproxy-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 405cf847121f4bfed32bc5679a40b64c1338b142af75823ef9583944a7ae7b5a On npm install via the prepare lifecycle hook and many other lifecycle aliases and on require, index.js performs broad reconnaissance and exfiltratio...

[SECURITY] Fedora 44 Update: perl-ExtUtils-Builder-0.020-1.fc44

Writing extensions for various build tools can be a daunting task. This module tries to abstract steps of build processes into reusable building blocks for creating platform and build system agnostic executable descriptions of work...

@142vip/fairy-cli (>=0.0.3-alpha.19, <=0.0.3-alpha.28), @better-builds/turbo-tools (>=6.0.0, <=7.4.4) +9 more potentially affected by CVE-2026-45773 via turbo (>=2.0.1, <=2.9.12)

turbo NPM version =2.0.1, =0.0.3-alpha.19, =6.0.0, =1.0.0, =0.0.234, =0.3.0, =1.5.1, =0.3.2, =0.5.0, =1.1.0, =1.4.1 - kbc-cinema-custom-app 1.0.0 Source cves: CVE-2026-45773 Source advisory: OSV:GHSA-HCF7-66RW-9F5R...

📄 OSK Privilege Escalation

This PowerShell script acts as a wrapper/launcher for a compiled Windows exploit binary targeting the OSK On-Screen Keyboard privilege escalation vulnerability. ================================================================================================================================== | Tit...

GHSA-R35X-V8P8-XVHW pyp2spec is Vulnerable to Code Injection

Impact pyp2spec was writing PyPI package metadata e.g. the summary field into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine. The macro...

OpenClaw 安全漏洞

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.8 contained security vulnerabilities. These vulnerabilities stemmed from the absence of blacklist entries for environment variables such as HGRCPATH, CARGOBUILDRUSTCWRAPPER,...

DEBIAN-CVE-2026-27903

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, matchOne performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent GLOBSTAR...

UBUNTU-CVE-2026-27903

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, matchOne performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent GLOBSTAR...

CVE-2026-27903 minimatch has a ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, matchOne performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent GLOBSTAR...

PT-2026-22078

Name of the Vulnerable Software and Affected Versions minimatch versions prior to 3.1.3 minimatch versions 3.1.3 through 4.2.5 minimatch versions 4.2.5 through 5.1.8 minimatch versions 5.1.8 through 6.2.2 minimatch versions 6.2.2 through 7.4.8 minimatch versions 7.4.8 through 8.0.6 minimatch...

@eui/deps-base (>=21.0.0-alpha.10, <=23.0.0-alpha.1), @eui/deps-base-light (>=21.0.0-alpha.10, <=23.0.0-alpha.1) +1 more potentially affected by CVE-2026-27739 via @angular-devkit/build-angular (>=21.0.0, <=21.1.0)

@angular-devkit/build-angular NPM version =21.0.0, =21.0.0-alpha.10, =21.0.0-alpha.10, =23.0.0-alpha.1 - ng-deploy-oss 21.0.0 Source cves: CVE-2026-27739 Source advisory: SNYK:JS-ANGULARDEVKITBUILDANGULAR-15357315...

EUVD-2026-3265

Malicious code in ofjaaah-build-tools npm...

Malicious code in ofjaaah-build-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0f994ed6a23b4449a3ab09537485788c488a90e26c56c52d309b4704d8d2da9 The package ofjaaah-build-tools was found to contain malicious code. Source: ghsa-malware...