OPENSUSE-SU-2026:20361-1 Security update for osc, obs-scm-bridge

This update for osc, obs-scm-bridge fixes the following issues: Changes in osc: - 1.24.0 - Command-line: - Add '--target-owner' option to 'git-obs repo fork' command - Add '--self' parameter to fix 'no matching parent repo' error message in 'git-obs pr create' - Fix 'osc aggregatepac' for scmsync...

acceldata-o2a (1.0.0), build-harness (0.2.1) +5 more potentially affected by CVE-2026-32274 via black (23.1.0a1)

black PYPI version 23.1.0a1 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - acceldata-o2a 1.0.0 - build-harness 0.2.1 - eth-brownie =1.15.0, =2.0.0, =2.0.1 - o2a-acceldata2 2.0.1 - pipenv-setup 2.2.1 - simmate 0.0.0.dev8...

Malicious Package

Overview transform-for-of is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior The...

Heap-based Buffer Overflow

Overview Magick.NET-Q16-HDRI-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

Heap-based Buffer Overflow

Overview Magick.NET-Q16-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

Access of Uninitialized Pointer

Overview Magick.NET-Q8-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

Malicious Package

Overview pcl-build-docroot is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-1361 Malicious code in pcl-build-docroot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec644efff0c2f83a615a174be4d854af6d4411fec2fd2246ce43b6118f6065fd The package pcl-build-docroot was found to contain malicious code. Source: ghsa-malware...

Malicious code in pcl-build-docroot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec644efff0c2f83a615a174be4d854af6d4411fec2fd2246ce43b6118f6065fd The package pcl-build-docroot was found to contain malicious code. Source: ghsa-malware...

Malicious code in npm-doc-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e02a5339e3c7017ad72be2bb9ed62f13b6d4aeef3450ada18af95a6203e8e105 The package npm-doc-build was found to contain malicious code. Source: ghsa-malware de3094bb10170209a4225724c5cc0934cbc551bbcf01dd6f6df0205ca158ee6a...

Malicious Package

Overview npm-doc-build is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

acceldata-o2a (1.0.0), build-harness (0.2.1) +5 more potentially affected by CVE-2026-31900 via black (23.1.0a1)

black PYPI version 23.1.0a1 is affected by a known vulnerability. The following packages have a transitive dependency on black and may be impacted: - acceldata-o2a 1.0.0 - build-harness 0.2.1 - eth-brownie =1.15.0, =2.0.0, =2.0.1 - o2a-acceldata2 2.0.1 - pipenv-setup 2.2.1 - simmate 0.0.0.dev8...

CVE-2026-2741

A flaw was found in Vaadin. During the automatic download and extraction of Node.js, a remote attacker could exploit a path traversal vulnerability. By intercepting or controlling the Node.js download, an attacker could serve a specially crafted ZIP archive. This malicious archive would allow fil...

CVE-2024-14026 QTS, QuTS hero

A command injection vulnerability has been reported to affect several QNAP operating system versions. If an attacker gains local network access who have also gained a user account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in th...

Out-of-bounds Write

Overview Magick.NET-Q16-HDRI-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Magick.NET-Q16-HDRI-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

GO-2026-4580 kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories in github.com/chainguard-dev/kaniko

kaniko has tar archive path traversal in its build context extraction, allowing file writes outside destination directories in github.com/chainguard-dev/kaniko...

CVE-2026-25573

A vulnerability has been identified in SICAM SIAPP SDK All versions V2.1.7. The affected application builds shell commands with caller-provided strings and executes them. An attacker could influence the executed command, potentially resulting in command injection and full system compromise...

KB5077474 - Description of the security update for SQL Server 2016 SP3 GDR: March 10, 2026

None None...

com.github.mcollovati:quarkus-hilla-commons-deployment (>=25.0.0-rc1, <=25.0.0), com.github.mcollovati:quarkus-hilla-deployment (>=25.0.0-rc1, <=25.0.0) +21 more potentially affected by CVE-2026-2741 via com.vaadin:flow-build-tools (>=25.0.0, <=25.0.3)

com.vaadin:flow-build-tools MAVEN version =25.0.0, =25.0.0-rc1, =25.0.0-rc1, =25.0.0-rc1, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.2 and more Source cves: CVE-2026-2741 Source advisory: MEND:CVE-2026-2741...