RLSA-2026:66248 Important: ansible-core security update

Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred t...

RockyLinux 8 : ansible-core (RLSA-2026:66248)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:66248 advisory. ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution CVE-2026-11332 Tenable has extracted the preceding description...

Security update for ansible-core (important)

openSUSE security update: security update for ansible-core ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21828-1 Rating: important References: bsc1272369 Cross-References: CVE-2026-11332 CVE-2026-16493 CVSS scores: CVE-2026-11332 SUSE : 7.8...

OPENSUSE-SU-2026:21828-1 Security update for ansible-core

This update for ansible-core fixes the following issues: - CVE-2026-16493: argument injection in ansible-galaxy collection install via git clone bsc1272369...

CLEANSTART-2026-RT26999 pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels

Multiple security vulnerabilities affect the k8s-sidecar package. pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. See references for individual vulnerability details...

GHSA-WCJJ-9M6G-2FR2 functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

MCP setfunctypeversion Package Alias RCE via Unsanitized pnpm install + Dynamic Import Summary The setfunctypeversion MCP tool in functype-mcp-server accepts an unconstrained version string, interpolates it directly into an npm package specifier functype@, and installs it via pnpm add without any...

NPM: functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

NPM: functype-mcp-server: MCP setfunctypeversion Package Alias RCE via Unsanitized pnpm install + Dynamic Import vulnerability discovered by ? in WordPress Npm functype-mcp-server versions = 1.4.3...

Important: Red Hat Security Advisory: ansible-core security update

An update for ansible-core is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Malicious code in @neroxkira/vangal-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6af1543fb92f079191de134bd36dbb64c340928804df8486acf43546e2c6e185 package.json declares libsignal with the source github:RILLYZY/libsignal-node, an unpinned reference to a third-party GitHub repository with no tag o...

MAL-2026-16103 Malicious code in @neroxkira/vangal-baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6af1543fb92f079191de134bd36dbb64c340928804df8486acf43546e2c6e185 package.json declares libsignal with the source github:RILLYZY/libsignal-node, an unpinned reference to a third-party GitHub repository with no tag o...

Malicious code in bq-sdist-probe-vrp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f61d3e118672e10f0dc02115acd8235c3b356d75e7cb59a69e26fec28070c814 setup.py executes at pip install time and performs installer-side credential and host reconnaissance. It queries the GCE/GCP metadata service at...

CVE-2026-57825

A flaw was found in the opam package manager for OCaml. This vulnerability allows a malicious package to bypass the sandbox protection mechanism. By mishandling symlinks during the processing of .install files, an attacker can write arbitrary files to unintended locations on the system, potential...

MAL-2026-16080 Malicious code in databricks-webapp-navigation-homepage (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 31ec3549efe09642c539f13af8a2a75949a356f55046b6298c21a2deedda322c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in databricks-webapp-navigation-homepage (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 31ec3549efe09642c539f13af8a2a75949a356f55046b6298c21a2deedda322c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in external_deps_enjoyer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d4909b60251f0448ff7bc689262f363e3ec4c2cebf82abe3eb0c7f8769931a6 package.json declares dependencies and optionalDependencies whose specifiers point at non-registry, attacker-controlled or mutable sources rather tha...

MAL-2026-16074 Malicious code in easypanel-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ac486399ab6c99cf83bfcf80e487c414fd29430e27f0d929ff7034ed333c7e8 The package's preinstall lifecycle script runs automatically on npm install and collects installer-side identifiers — os.hostname,...

MAL-2026-16075 Malicious code in easypanel-hosting (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db6a378b33bb2f33088ed90db4ac48e81368e30d5ef38578dca3b4345e9cb06b [email protected] ships a stub index.js module.exports = and an npm preinstall lifecycle script that collects the installer's hostname, usernam...

CVE-2026-57825

In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files...

Malicious code in bx-ui-view (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce3874d2c55544bbbf59b6a60c3002b13e242fb53160a455597b13fdd37231f8 package.json declares a dependency whose key equals the package's own name bx-ui-view and whose value is a plain HTTPS URL...

Malicious code in rojo-rbx (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bf25c0dd3a1b933c3ee2fe887301590c3b92e383a1e6c380fcdb9544578720b The package impersonates the legitimate Rojo Roblox tooling project. Its npm install lifecycle runs scripts/install.js, which on Windows downloads a...