@3w5h/knowledge_query (1.0.30), @3w5h/utils (>=1.0.0, <=1.0.7) +662 more potentially affected by CVE-2026-73567 via sm-crypto (>=0.0.9, <=0.4.0)

sm-crypto NPM version =0.0.9, =1.0.0, =0.1.0, =1.0.13, =4.4.42, =0.0.2, =2.2.6, =2.2.6, =2.2.6, =2.3.10, =2.1.4, =2.2.6, =2.2.6, =2.2.6, =2.7.8-alpha.2 - @ancademy/bespoke-group-share 2.5.1 and more Source cves: CVE-2026-73567 Source advisory: OSV:GHSA-VH45-F885-3848...

CVE-2026-64208

Summary : CVE-2026-64208 affects the Linux kernel’s crypto/krb5 and AF_RXRPC path. The root cause was missing pre-decrypt/pre-verify length checks, now fixed by updating the krb5 crypto library to provide facilities for prechecking message length and by applying this in AF_RXRPC to validate DATA ...

CVE-2026-64208 crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks

In the Linux kernel, the following vulnerability has been resolved: crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks Change the krb5 crypto library to provide facilities to precheck the length of the message about to be decrypted or verified. Fix AFRXRPC to make use of this to...

Malicious code in karpatkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df2d9d6dd18d56c6ef8303bc90a0254383b3a7b0f202f5e50b7a1c6ceafd77f7 On import karpatkit, the top-level init.py invokes compat.check which spawns a daemon thread that collects os.environ, the Kubernetes service-account...

MAL-2026-11048 Malicious code in karpatkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df2d9d6dd18d56c6ef8303bc90a0254383b3a7b0f202f5e50b7a1c6ceafd77f7 On import karpatkit, the top-level init.py invokes compat.check which spawns a daemon thread that collects os.environ, the Kubernetes service-account...

Malicious code in karpatkey (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b434ae7cf6afb9ce18a54757c03069983e404db695d959bd29aa628864b8349c On import karpatkey, the top-level karpatkey/init.py spawns a daemon background thread that walks the installer's home directory and collects SSH...

MAL-2026-11047 Malicious code in karpatkey (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b434ae7cf6afb9ce18a54757c03069983e404db695d959bd29aa628864b8349c On import karpatkey, the top-level karpatkey/init.py spawns a daemon background thread that walks the installer's home directory and collects SSH...

Oracle Linux 10 : buildah (ELSA-2026-29195)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-29195 advisory. - rebuild for CVE-2026-39822 - bump golang.org/x/crypto to v0.52.0 to fix CVE-2026-39830 - Rebuild for CVE-2026-25679 Tenable has extracted the...

SUSE SLES15 Security Update : kubevirt (SUSE-SU-2026:3203-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3203-1 advisory. - Security: re-vendor the bundled Go dependencies no upstream source changes; tarball rebuilt from v1.7.4 with updated go.mod/vendo...

CVE-2026-43823

When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

CVE-2026-43823

When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

EUVD-2026-48288

When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

CVE-2026-43823

The CVE describes a double-free in EVP_PKEY* when initializing an RSA public key from DER/PEM bytes if decoding fails. The double-free occurs first in the catch block and again in deinit, potentially causing a crash on subsequent memory allocations. Affected code path manifests when BoringSSL can...

CVE-2026-43823

When initializing an RSA public key from DER or PEM bytes throws an error, the EVPPKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

Security update for kubevirt

This update for kubevirt fixes the following issues: Security: re-vendor the bundled Go dependencies no upstream source changes; tarball rebuilt from v1.7.4 with updated go.mod/vendor: golang.org/x/net v0.48.0 - v0.55.0: CVE-2026-33814 bsc1265736, CVE-2026-39821 bsc1266575, CVE-2026-25680,...

SUSE-SU-2026:3203-1 Security update for kubevirt

This update for kubevirt fixes the following issues: - Security: re-vendor the bundled Go dependencies no upstream source changes; tarball rebuilt from v1.7.4 with updated go.mod/vendor: golang.org/x/net v0.48.0 - v0.55.0: CVE-2026-33814 bsc1265736, CVE-2026-39821 bsc1266575, CVE-2026-25680,...

PT-2026-64003

When initializing an RSA public key from DER or PEM bytes throws an error, the EVP PKEY is double-freed: first in the catch block, then in the deinit. This can lead to a crash on future memory allocations. This double-free manifests when BoringSSL cannot decode the public key from the bytes...

Oracle Linux 10 : kernel (ELSA-2026-42919)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42919 advisory. - fanotify: fix false positive on permission events CKI Backport Bot RHEL-180076 CVE-2026-46150 - ice: fix double-free of txbuf skb Jakub Ramaseuski...

Oracle Linux 10 : kernel (ELSA-2026-19569)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19569 advisory. - crypto: ccp - copy IV using skcipher ivsize CKI Backport Bot RHEL-188463 CVE-2026-53016 - futex/requeue: Revert 'Prevent NULL pointer dereference i...

kernel: crypto: af_alg - zero initialize memory allocated via sock_kmalloc

A flaw was found in the Linux kernel's crypto AFALG subsystem. Memory allocated via sockkmalloc for crypto user API contexts is not zero-initialized, leaving fields with garbage values. Specifically, the 'inflight' variable can contain random data, causing afalgallocareq to spuriously return -EBU...