EUVD-2026-81730

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobjelem + posvalues while copying the supported password encodings from the ACPI package. The outer loop only guarantees...

CVE-2026-90137 platform/x86: hp-bioscfg: fix password encoding bounds check

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix password encoding bounds check The password PSWDENCODINGS parser reads passwordobjelem + posvalues while copying the supported password encodings from the ACPI package. The outer loop only guarantees...

CVE-2026-90137

CVE-2026-90137 is an out-of-bounds read in the hp-bioscfg platform driver of the Linux kernel. The PSWD_ENCODINGS parser reads password_obj[elem + pos_values] while copying supported password encodings from an ACPI package, but lacks a bounds check on the computed index. A malformed ACPI package ...

GHSA-6FVH-FGMG-3X7V Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c48m-32m9-vx93. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses...

GO-2026-6444 vulnerabilities

Vulnerabilities for packages: crossplane-cli-fips, kaniko, packer-fips, kube-mgmt-fips, headlamp, rancher, chaos-mesh-fips, trivy-operator, kubescape, tigera-operator-fips, harvester-fips, neuvector-fips, helm-exporter-fips, kgateway, redpanda-operator, zarf, helm-push, helm-operator, nerdctl,...

CVE-2026-92951 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowliste...

ROOT-APP-NPM-CVE-2026-56876 CVE-2026-56876 in extract-zip - Patched by Root

Root has patched CVE-2026-56876 in the extract-zip package for Root:npm. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-1597 CVE-2024-1597 in org.postgresql:postgresql - Patched by Root

Root has patched CVE-2024-1597 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-GR75-JV2W-4656 GHSA-gr75-jv2w-4656 in langchain - Patched by Root

Root has patched GHSA-gr75-jv2w-4656 in the langchain package for Root:PyPI. Multiple fixed versions available...

Malicious Package

Overview layla-poke40 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview leadconduit-twilio is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ldoash is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview leadconduit-homesdotcom is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview leda-janus-solis-dynamo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview leadconduit-autoresponder is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview leadingmulez3n is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview leadconduit-salesforce is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview ldhemrdhs92004 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview leadconduit-national-renewable-energy-lab is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious Package

Overview leadconduit-marketo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...