MAL-2026-11195 Malicious code in phabricator-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43e718b20986295f99dd35066e46d0be5629555dccab79a1727cd3f5044cb7a0 phabricator-client 99.0.4 is a single-file PyPI package whose only runtime effect on import is to resolve lobohunter.duckdns.org and open a TCP...

io.vertx/vertx-web: Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation

A flaw was found in Eclipse Vert.x Web Client. The WebClientSession component does not properly validate the Domain attribute of a Set-Cookie response header against the originating server's domain. This vulnerability allows a remote attacker to inject a cookie scoped to an arbitrary third-party...

CLEANSTART-2026-WO51731 Security fixes in k8ssandra-client-fips 0.6.4-r7

Package k8ssandra-client-fips version 0.6.4-r7 fixes 10 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288...

CLEANSTART-2026-MB96835 Security fixes in k8ssandra-client-fips 0.8.10-r0

Package k8ssandra-client-fips version 0.8.10-r0 fixes 4 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-EC51762 Security fixes in minio-client-fips 0.20250416181326-r0

Package minio-client-fips version 0.20250416181326-r0 fixes 1 vulnerabilities: CVE-2022-41717...

CLEANSTART-2026-YF94250 Security fixes in k8ssandra-client-fips 0.5.0-r7

Package k8ssandra-client-fips version 0.5.0-r7 fixes 4 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-UV81951 Security fixes in k8ssandra-client-fips 0.8.8-r0

Package k8ssandra-client-fips version 0.8.8-r0 fixes 4 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-MI75694 Security fixes in k8ssandra-client-fips 0.7.0-r5

Package k8ssandra-client-fips version 0.7.0-r5 fixes 11 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32288...

CLEANSTART-2026-DV38059 Security fixes in k8ssandra-client-fips 0.6.4-r6

Package k8ssandra-client-fips version 0.6.4-r6 fixes 4 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139, ghsa-p77j-4mvh-x3m3...

CLEANSTART-2026-ZM65056 Security fixes in k8ssandra-client-fips 0.7.0-r7

Package k8ssandra-client-fips version 0.7.0-r7 fixes 13 vulnerabilities: ghsa-mh2q-q3fh-2475, CVE-2026-39820, CVE-2026-39819, CVE-2026-29181, CVE-2026-42499...

CLEANSTART-2026-WH63397 Security fixes in k8ssandra-client-fips 0.6.4-r5

Package k8ssandra-client-fips version 0.6.4-r5 fixes 5 vulnerabilities: CVE-2025-61726, CVE-2025-61730, CVE-2025-61728, CVE-2025-68119, CVE-2025-61731...

CVE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

UBUNTU-CVE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions

A flaw was found in OpenSSH. A local unprivileged attacker on a Linux client host can hijack client-side X11 forwarding connections. This is possible by pre-binding the preferred abstract X socket name when X11 forwarding is enabled and a local UNIX-domain X socket is used. A successful attack ca...

openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side

A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability...

CVE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

CVE-2026-56850

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...

EUVD-2026-50979

The Spring Boot language server logs the raw value of the httpsproxy/HTTPSPROXY/httpproxy/HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentia...

CVE-2026-59326

The Spring Boot language server logs the raw value of the httpsproxy/HTTPSPROXY/httpproxy/HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentia...

kernel: smb: client: fix OOB reads parsing symlink error response

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote, untrusted server could send a specially crafted symlink error response, leading to an out-of-bounds read vulnerability. This could result in the disclosure of sensitive information from the kernel's memory to a loca...