MAL-2026-1688 Malicious code in chain-promised (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fd6ee3247632a88a25b8059314727f1757ed1163081b133945fbe4af59e5d28 The package chain-promised was found to contain malicious code...

MAL-2026-1590 Malicious code in @cbreone/core-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7e204888ba2b9573e474d804f28f51173684bb25f640615a9eaae217c5e1a45 The package @cbreone/core-ui was found to contain malicious code...

RHSA-2026:4438 Red Hat Security Advisory: freerdp security update

Bulletin has no description...

RHSA-2026:3516 Red Hat Security Advisory: thunderbird security update

Bulletin has no description...

DEBIAN-CVE-2026-3202

NTS-KE protocol dissector crash in Wireshark 4.6.0 to 4.6.3 allows denial of service...

RHSA-2026:2817 Red Hat Security Advisory: pcs security update

Bulletin has no description...

AZL-76859 CVE-2025-47911 affecting package application-gateway-kubernetes-ingress 1.7.7-2

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service DoS if an attacker provides specially crafted HTML content...

CLEANSTART-2026-AV38242 Cancelling a query (e

Multiple security vulnerabilities affect the fluent-operator-fips package. Cancelling a query e. See references for individual vulnerability details...

CLEANSTART-2026-IW06531 excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate

Multiple security vulnerabilities affect the istio-pilot-discovery-fips package. An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. See references for individual vulnerability details...

RHSA-2026:1558 Red Hat Security Advisory: python3 security update

Bulletin has no description...

DSA-6107-1 bind9 - security update

Bulletin has no description...

Malicious Package

Overview elf-stats-nutmeg-sleigh-350 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

CLSA-2025-1765451524 Fix CVE(s): CVE-2025-53057, CVE-2025-53066, CVE-2025-61748

OpenJDK 8u472 release - CVE-2025-53057: fix unauthorized remote data-modification - CVE-2025-53066: fix unauthorized remote data access - CVE-2025-61748: fix limited remote unauthorized data modification - Release notes: https://mail.openjdk.org/pipermail/jdk8u-dev/2025-October/thread.html...

EUVD-2025-199914

Malicious code in com.unity.sharp-zip-lib npm...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

EUVD-2025-178103

Malicious code in library-frontend-update-eclipse npm...

siddheshtea (=1.1.6) potentially affected by unknown CVE via nokire-nakala37 (=1.0.0)

nokire-nakala37 NPM version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on nokire-nakala37 and may be impacted: - siddheshtea =1.1.6 Source cves: unknown CVE Source advisory: OSV:MAL-2025-162990...

MAL-2025-144370 Malicious code in library-betelgeuse-yonder-scorpius (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40d464d999af81bcaceefdd858dd914d406dc75800c99c9aaf27487492862826 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ocha-tapai94-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b9f8f3721d08f177135a6f90338d52636c1d445b0d7921eccd49a7e7711e0569 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-76711 Malicious code in ade-lumpur59-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bea8f2d526cfb499576baa7f93363a08efc408504d223a14996f4c200d5ea269 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...