211227 matches found
ROOT-APP-NPM-CVE-2025-68428 CVE-2025-68428 in jspdf - Patched by Root
Root has patched CVE-2025-68428 in the jspdf package for Root:npm. Multiple fixed versions available...
Malicious code in pfa-errors (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e06752c5f827cccdf98f23fa26d893d44e2889b8b7011e8fdb130524f09fe0f On require'pfa-errors', index.js unconditionally loads runtime.js, which fetches a platform-specific opaque binary from one of three hardcoded...
Important: Red Hat Security Advisory: libpq security update
An update for libpq is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
ROOT-APP-NUGET-CVE-2026-26171 CVE-2026-26171 in Rootio.System.Security.Cryptography.Xml - Patched by Root
Root has patched CVE-2026-26171 in the Rootio.System.Security.Cryptography.Xml package for Root:NuGet. Multiple fixed versions available...
ROOT-APP-NUGET-CVE-2025-55247 CVE-2025-55247 in Rootio.Microsoft.Build.Tasks.Core - Patched by Root
Root has patched CVE-2025-55247 in the Rootio.Microsoft.Build.Tasks.Core package for Root:NuGet. Multiple fixed versions available...
MAL-2026-12330 Malicious code in @vboxdev/common (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4b16f8f98ad89c1276884f96b2ef878d2c597356aa2194c7067d2d0bbda943f build/index.js appends an evalatob'...' block that fires when the module is required. The decoded payload queries Ethereum JSON-RPC endpoints...
CVE-2026-71226
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers...
EUVD-2026-53375
Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers...
Malicious code in pfp-block-independent-iframe (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2145fdce1d6879c4b5bd3682bf9b8e7c386f3f80f15721c26fe6bd2638564185 On require of the package, index.js loads bootstrap.js, which selects a platform-specific payload path, fetches bytes from one of four...
MAL-2026-12450 Malicious code in statist-browser-typed-client-risktech.uwfrontantifraud.events (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e4bd3cdacfc8ad3f6e278f3bdfa4c19ed82be8ad966863c91c176af4f712d26 On require/import, compat.js reached from index.js downloads a platform-specific executable from hardcoded Cloudflare Workers subdomains...
ROOT-OS-DEBIAN-13-CVE-2026-12087 CVE-2026-12087 in perl - Patched by Root
Root has patched CVE-2026-12087 in the perl package for Root:Debian:13. Multiple fixed versions available...
CVE-2026-71281
The CVE-2026-71281 details a vulnerability in Hugging Face PEFT: LoRA-GA and CorDA initialization modules call torch.load() on cache/covariance files without weights_only=True, bypassing PEFT’s safe-loading wrapper. This full pickle deserialization can lead to arbitrary code execution if a malici...
CVE-2026-71269
CVE-2026-71269 affects Node-RED’s local-filesystem library storage module (getLibraryEntry() and saveLibraryEntry() in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js). The vulnerability arises because GET/POST requests to /library/:lib/:type/*path join the user-sup...
CVE-2026-71269 Node-RED Library API Path Traversal Leading to Arbitrary File Read/Write
Node-RED's local-filesystem library storage module getLibraryEntry and saveLibraryEntry in packages/nodemodules/@node-red/runtime/lib/storage/localfilesystem/library.js, reachable via GET/POST /library/:lib/:type/path, joins the user-supplied path parameter directly into the filesystem path via...
Malicious code in ccxt-trading (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0442271e1969ce5899ac9176cf8dfed0dbf8edd46fecf99ee8e3cd4f21a92d8 Package name resembles the popular ccxt library. The exported ProExchange constructor, invoked whenever a consumer instantiates any exchange through...
DEBIAN-CVE-2026-64582
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix a use-after-free problem in rxemmap rxemmap removes a rxemmapinfo struct from the pendingmmaps list and releases pendinglock while the struct's kref is still at 1: listdelinit&ip-pendingmmaps;...
CGA-3JR9-VHCV-J8P6
Bulletin has no description...
CGA-FQ3M-M84V-79P6
Bulletin has no description...