ROOT-APP-PYPI-CVE-2025-67221 CVE-2025-67221 in orjson - Patched by Root

Root has patched CVE-2025-67221 in the orjson package for Root:PyPI. Multiple fixed versions available...

CVE-2026-15656

CVE-2026-15656 affects IBM Maximo Application Suite (MAS) 9.2, 9.1, and 9.0. The issue is that authorization tokens and session cookies are not marked with the Secure attribute, allowing cookies to be exposed if a user visits an http link or a site containing such a link. As described in the conn...

CVE-2026-69192

A flaw was found in the ip-address library. This library incorrectly interprets IPv4 address octets with leading zeros as decimal, while standard network parsers interpret them as octal. This inconsistency can cause applications to misclassify network targets, allowing a remote attacker to bypass...

CVE-2026-69198

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IP addresses. By appending a Classless Inter-Domain Routing CIDR suffix to an IP address, an attacker can bypass the library's special-use classification methods. This misclassification can lead applications, such a...

MAL-2026-13252 Malicious code in bigops-storio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 072daea48b555582ea01125b1a71fff5907e73bc890ec56f7b012ac38230b69e On require of bigops-storio, support.js selects a platform-specific endpoint and fetches an opaque binary over HTTPS from one of four string-split...

MAL-2026-13323 Malicious code in dolyame-boxy-independent-bnpl-origination (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0512db79eba207153d2427271566e3ecd016d3d817266e683a801d82183254e9 On require, index.js loads ext.js which detects platform, constructs C2 hostnames by joining split string fragments e.g. "oob-worker.cf99-9b3.worker"...

MAL-2026-13318 Malicious code in dolyame-boxy-independent-bnpl-info-slider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1752274e08bd28f5be07afaa71cafeea1e7822330016892d0f06abd6c50681 On require of the package, index.js loads vendor.js which downloads a platform-specific binary from a string-concatenation-obfuscated list of...

gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an...

DEBIAN-CVE-2026-54876

Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim clien...

ROOT-APP-PYPI-GHSA-MV93-W799-CJ2W GHSA-mv93-w799-cj2w in GitPython - Patched by Root

Root has patched GHSA-mv93-w799-cj2w in the GitPython package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-41313 CVE-2026-41313 in pypdf - Patched by Root

Root has patched CVE-2026-41313 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-40260 CVE-2026-40260 in pypdf - Patched by Root

Root has patched CVE-2026-40260 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-33123 CVE-2026-33123 in pypdf - Patched by Root

Root has patched CVE-2026-33123 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-41168 CVE-2026-41168 in pypdf - Patched by Root

Root has patched CVE-2026-41168 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-7GW9-CF7V-778F GHSA-7gw9-cf7v-778f in pypdf - Patched by Root

Root has patched GHSA-7gw9-cf7v-778f in the pypdf package for Root:PyPI. Multiple fixed versions available...

MINI-H3R3-G9P4-94VJ

Bulletin has no description...

MINI-XX2Q-MJ2W-CXXR

Bulletin has no description...

MAL-2026-12702 Malicious code in devplatform-cli-plugin-lint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8460a9cc2fce88e69d25156ea88612a5a67ffba26709ce88900d573e2f4b3ea On require of the package, index.js loads bootstrap.js which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32, downloads an...

ROOT-OS-DEBIAN-12-CVE-2026-3446 CVE-2026-3446 in python3.11 - Patched by Root

Root has patched CVE-2026-3446 in the python3.11 package for Root:Debian:12. Multiple fixed versions available...

Malicious code in devplatform-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30b21acc89730541bc58390e2694a9e5410417e5232bb4f4d47c0c27b035e2f4 Package is published as an i18n library but its main entry index.js requires./setup on load. setup.js selects a per-platform payload path, fetches...