AlmaLinux 9.6 [TuxCare] Security Update: libssh / libssh-config / libssh-devel Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1786549709)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1786549709 advisory. - A flaw was found in libssh. A remote authenticated peer can advertise a zero maximum packet size in SSHMSGCHANNELOPEN, causing lat...

CVE-2026-47096

AJA HELO Plus firmware versions before 2.1.7 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is an unsanitized eParamID_SystemName value accepted through the /config?action=set web configuration API. Unauthenticated attackers with network access can inject malicious Jav...

CVE-2026-47096 AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...

CVE-2026-47096 AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter

AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network access to inject malicious JavaScript by setting an unsanitized eParamIDSystemName value through the /config?action=set web configuration API. Attackers can...

CVE-2026-103548

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user...

CVE-2026-103548

The Itron MV-90 xi 3.0 contains improperly stored passwords within its configuration file. This vulnerability allows an attacker to decode both current passwords and password histories, potentially granting unauthorized access to the MV-90 application as any user. No specific remediation steps or...

CVE-2026-103548 Improperly Stored Credentials

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user...

CVE-2026-103548 Improperly Stored Credentials

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user...

EUVD-2026-90362

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user...

@langri-sha/projen-babel (>=0.5.11, <=0.5.12), @langri-sha/projen-eslint (>=0.3.12, <=0.3.13) +6 more potentially affected by CVE-2026-97711 via serialize-javascript (7.1.1)

serialize-javascript NPM version 7.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on serialize-javascript and may be impacted: - @langri-sha/projen-babel =0.5.11, =0.3.12, =0.4.13, =0.3.13, =0.4.12, =0.29.0, =0.65.78-next.15, =0.4.0, =0.6.1 Source...

@langri-sha/projen-babel (>=0.5.11, <=0.5.12), @langri-sha/projen-eslint (>=0.3.12, <=0.3.13) +6 more potentially affected by CVE-2026-97711 via serialize-javascript (7.1.1)

serialize-javascript NPM version 7.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on serialize-javascript and may be impacted: - @langri-sha/projen-babel =0.5.11, =0.3.12, =0.4.13, =0.3.13, =0.4.12, =0.29.0, =0.65.78-next.15, =0.4.0, =0.6.1 Source...

Malicious Package

Overview ssp-config-management-tool is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview eslint-config-epic is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview epic-webpack-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

libdm: lvm2: libdm: Denial of Service via uncontrolled recursion in config parser

A flaw was found in libdm. A local attacker could craft a malicious Logical Volume Manager LVM metadata configuration with deeply nested structures. This could lead to uncontrolled recursion in the libdm configuration file parser, exhausting the stack and causing any LVM command reading the...

Malicious Package

Overview @hrmony/api-gateway-service-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview @hrmony/pladddform-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

PT-2026-103534

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.0 Description An OS Command Injection flaw exists where an authenticated administrator can upload a configuration package with insufficiently validated contents. Processing a crafted package allows the...

PT-2026-103625

Name of the Vulnerable Software and Affected Versions AJA HELO Plus versions prior to 2.1.7 Description A stored cross-site scripting issue exists that allows unauthenticated attackers with network access to inject malicious JavaScript. This occurs when the eParamID SystemName variable is set wit...

CVE-2026-103548: Storing Passwords in a Recoverable Format

Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain access to the MV-90 application as any user...