PT-2026-63074

Name of the Vulnerable Software and Affected Versions Oracle Agile Engineering Data Management version 6.2.1 Description A flaw in the Install component allows a low privileged attacker with network access via HTTP to compromise the system. Exploitation is difficult and requires human interaction...

PT-2026-63070

Name of the Vulnerable Software and Affected Versions Oracle Agile Engineering Data Management version 6.2.1 Description An issue in the Install component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized rea...

MAL-2026-10990 Malicious code in ts-vitest (npm)

ts-vitest is a typosquat of vitest/ts-eslint hollow "kelly-calc"/"clob-math" content, no legitimate functionality that ships a postinstall two-stage fetch-exec dropper. The package.json declares postinstall: node scripts/install-check.cjs; the hook's resolvePeerBundleUrl fetches a JSON config fro...

MAL-2026-11042 Malicious code in faust-cont (npm)

The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...

CVE-2026-61186: Improper Access Control

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain component: Install. The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Engineering Da...

Malicious code in ts-vitest (npm)

ts-vitest is a typosquat of vitest/ts-eslint hollow "kelly-calc"/"clob-math" content, no legitimate functionality that ships a postinstall two-stage fetch-exec dropper. The package.json declares postinstall: node scripts/install-check.cjs; the hook's resolvePeerBundleUrl fetches a JSON config fro...

CVE-2026-61187: Improper Resource Shutdown or Release

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain component: Install. The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data...

Malicious code in faust-cont (npm)

The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...

EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2744)

According to the versions of the packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if th...

CVE-2026-62574: Improper Access Control

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Install. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12; Orac...

GHSA-GJFG-22FP-RRXX Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files

Summary A Composer package declares its executables in the bin field of its composer.json. When Composer installs a package, it processes each bin entry and changes the file mode of the corresponding file so it is executable. If a bin entry contains .. path segments, it can resolve to a path...

EUVD-2026-42362

Composer: Arbitrary file write outside vendor via malicious transitive package name...

ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

CVE-2026-16247

The CVE affects _connect.BRAIN prior to version 5.06. During setup, LogPathConfig.exe is executed and deletes/recreates %ProgramData% permissions, granting the Windows group Everyone full control instead of restricting access to %ProgramData\Bizerba_connect.BRAIN or %ProgramData\Bizerba\BCT. Star...

Security update for systemd, systemd-mini

This update for systemd, systemd-mini fixes the following issues Changes for systemd: Import commit 435c5779a785b4263b4dcacb70f50ef1cc3f9a7b bsc1267647. Import commit 7aa089f75b77b2db22941081c37b8917ea8d0dda bsc1261982. udev/scsi-id: check for invalid chars in various fields received from the...

MAL-2026-10946 Malicious code in @akrai/core (npm)

The @akrai/core package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

Malicious code in iphouse-api (npm)

The iphouse-api package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

Malicious code in akrai-report-new (npm)

The akrai-report-new package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms...