MAL-2026-4997 Malicious code in @cloudplatform-single-spa/virtual-ip (npm)

Part of a dependency confusion attack campaign targeting the @cloudplatform-single-spa and @mlspace npm scopes. The attacker npm user mr.4nd3r50n published 139 scoped packages at the inflated version 99.99.99, which resolves ahead of any private registry version via npm's default version...

Malicious code in rogiant-install (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0c659d6e1e7b9bbbbb7b808196db4231a5eb1a62fe91827fc02fd708b92728b5 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

MAL-2026-4835 Malicious code in rogiant-install (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0c659d6e1e7b9bbbbb7b808196db4231a5eb1a62fe91827fc02fd708b92728b5 During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +165 more potentially affected by CVE-2026-45618 via liquidjs (>=10.2.0, <=10.25.7)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.8.0, =12.0.0, =1.0.1-beta.0, =1.0.2 and more Source cves: CVE-2026-45618 Source advisory: OSV:GHSA-GF2Q-C269-PQGC...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +165 more potentially affected by CVE-2026-45618 via liquidjs (>=10.2.0, <=10.25.7)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.8.0, =12.0.0, =1.0.1-beta.0, =1.0.2 and more Source cves: CVE-2026-45618 Source advisory: SNYK:JS-LIQUIDJS-16959997...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +165 more potentially affected by CVE-2026-45617 via liquidjs (>=10.2.0, <=10.25.7)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.8.0, =12.0.0, =1.0.1-beta.0, =1.0.2 and more Source cves: CVE-2026-45617 Source advisory: OSV:GHSA-R7G9-XPMJ-5FCQ...

@agiflowai/aicode-toolkit (>=0.6.0, <=1.1.0), @agiflowai/one-mcp (0.4.0) +101 more potentially affected by CVE-2026-45617 via liquidjs (>=10.15.0, <=10.25.7)

liquidjs NPM version =10.15.0, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.8.0, =1.0.1-beta.0, =1.6.3, =3.11.0-rc.0, =3.11.0-rc.0, =3.20.0-rc1 and more Source cves: CVE-2026-45617 Source advisory: SNYK:JS-LIQUIDJS-16960001...

cashd (>=0.1.0, <=0.3.4.post1), taipy-utils (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-48544 via taipy (>=3.1.0, <=4.1.1)

taipy PYPI version =3.1.0, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2026-48544 Source advisory: SNYK:PYTHON-TAIPY-17178796...

@agiflowai/aicode-toolkit (>=0.6.0, <=1.1.0), @agiflowai/one-mcp (0.4.0) +101 more potentially affected by CVE-2026-45357 via liquidjs (>=10.15.0, <=10.25.7)

liquidjs NPM version =10.15.0, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.8.0, =1.0.1-beta.0, =1.6.3, =3.11.0-rc.0, =3.11.0-rc.0, =3.20.0-rc1 and more Source cves: CVE-2026-45357 Source advisory: SNYK:JS-LIQUIDJS-16960002...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +165 more potentially affected by CVE-2026-45357 via liquidjs (>=10.2.0, <=10.25.7)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.8.0, =12.0.0, =1.0.1-beta.0, =1.0.2 and more Source cves: CVE-2026-45357 Source advisory: OSV:GHSA-HH27-HF48-9F5Q...

AZL-88692 CVE-2026-45901 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: revert commitmutex usage in reset path It causes circular lock dependency between commitmutex, nfnlsubsysipset and nlkcbmutex when nft reset, ipset list, and iptables-nft with '-m set' rule run at the same...

CVE-2026-45901

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: revert commitmutex usage in reset path It causes circular lock dependency between commitmutex, nfnlsubsysipset and nlkcbmutex when nft reset, ipset list, and iptables-nft with '-m set' rule run at the same...

SUSE-SU-2026:2092-1 Security update for go1.26-openssl

This update for go1.26-openssl fixes the following issues Security issues: - CVE-2026-33811: net: crash when handling long CNAME response bsc1264508. - CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1264506. - CVE-2026-39817: cmd/go: 'go tool...

@userfront/bell (>=5.2.3-0, <=6.0.0), ffc-auth (>=0.1.0-alpha.1, <=0.13.0-alpha.2) +1 more potentially affected by CVE-2026-44979 via @hapi/wreck (>=18.0.0, <=18.0.1)

@hapi/wreck NPM version =18.0.0, =5.2.3-0, =0.1.0-alpha.1, =1.0.2, =1.0.4 Source cves: CVE-2026-44979 Source advisory: OSV:GHSA-VHJM-W67Q-G75C...

@userfront/bell (>=5.2.3-0, <=6.0.0), ffc-auth (>=0.1.0-alpha.1, <=0.13.0-alpha.2) +1 more potentially affected by CVE-2026-44979 via @hapi/wreck (>=18.0.0, <=18.0.1)

@hapi/wreck NPM version =18.0.0, =5.2.3-0, =0.1.0-alpha.1, =1.0.2, =1.0.4 Source cves: CVE-2026-44979 Source advisory: SNYK:JS-HAPIWRECK-16881586...

org.webjars.npm:bazel__karma (1.7.0), org.webjars.npm:broccoli-merge-trees (2.0.0) +15 more potentially affected by CVE-2026-44705 +1 more via org.webjars.npm:tmp (>=0.0.24, <=0.2.3)

org.webjars.npm:tmp MAVEN version =0.0.24, =2.1.0, =0.19.11, =0.2.11, =3.2.3, =6.5.0, =2.52.0, =4.10.0 - org.webjars.npm:snyk-go-plugin 1.5.2 - org.webjars.npm:snyk-python-plugin 1.8.1 and more Source cves: CVE-2026-44705, CVE-2026-49982 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-16881241...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +165 more potentially affected by CVE-2026-44646 via liquidjs (>=10.2.0, <=10.25.7)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.8.0, =12.0.0, =1.0.1-beta.0, =1.0.2 and more Source cves: CVE-2026-44646 Source advisory: SNYK:JS-LIQUIDJS-16887887...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +165 more potentially affected by CVE-2026-44646 via liquidjs (>=10.2.0, <=10.25.7)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.8.0, =12.0.0, =1.0.1-beta.0, =1.0.2 and more Source cves: CVE-2026-44646 Source advisory: OSV:GHSA-9X9P-QF8F-MVJG...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +165 more potentially affected by CVE-2026-44645 via liquidjs (>=10.2.0, <=10.25.7)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.8.0, =12.0.0, =1.0.1-beta.0, =1.0.2 and more Source cves: CVE-2026-44645 Source advisory: SNYK:JS-LIQUIDJS-16882546...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +165 more potentially affected by CVE-2026-44645 via liquidjs (>=10.2.0, <=10.25.7)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =0.5.5, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.0.1-alpha.0, =0.8.0, =12.0.0, =1.0.1-beta.0, =1.0.2 and more Source cves: CVE-2026-44645 Source advisory: OSV:GHSA-8XX9-69P8-7JP3...