-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +19071 more potentially affected by CVE-2026-67319 via axios (>=1.0.0, <=1.17.0)

axios NPM version =1.0.0, =0.0.8, =0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, =1.0.53, =0.1.0, =1.0.1, =1.0.0, =0.1.0, =0.0.1, =0.0.1, =0.1.2, =1.1.0, =2.0.0 and more Source cves: CVE-2026-67319 Source advisory: OSV:GHSA-7Q8Q-RJ6J-MHJQ...

0xtrails (>=0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, <=0.17.1), 123pancli (1.0.0) +6612 more potentially affected by CVE-2026-67315 via axios (>=1.15.0, <=1.17.0)

axios NPM version =1.15.0, =0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, =0.1.0, =1.1.0, =0.1.0, =1.0.21, =0.1.4, =0.1.0, =1.0.10, =1.0.10, =0.6.6, =0.6.10, =0.6.9, =0.6.15 - @0xdeepak/wallets 0.0.2 and more Source cves: CVE-2026-67315 Source advisory: OSV:GHSA-F4GW-2P7V-4548...

0xtrails (>=0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, <=0.17.1), 123pancli (1.0.0) +6612 more potentially affected by CVE-2026-67315 via axios (>=1.15.0, <=1.17.0)

axios NPM version =1.15.0, =0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, =0.1.0, =1.1.0, =0.1.0, =1.0.21, =0.1.4, =0.1.0, =1.0.10, =1.0.10, =0.6.6, =0.6.10, =0.6.9, =0.6.15 - @0xdeepak/wallets 0.0.2 and more Source cves: CVE-2026-67315 Source advisory: SNYK:JS-AXIOS-18065357...

@adobe/aem-cli (>=16.21.1, <=16.21.2), @adobe/helix-docx2md (>=1.9.29, <=1.9.30) +48 more potentially affected by CVE-2026-59870 via js-yaml (>=5.0.0, <=5.2.0)

js-yaml NPM version =5.0.0, =16.21.1, =1.9.29, =3.4.141, =7.1.20, =2.2.62, =1.5.3, =1.0.8, =1.0.0-alpha.1, =0.0.0-next-20260630092247, =0.0.0-next-20260630092247, =0.0.0-next-20260813201118 and more Source cves: CVE-2026-59870 Source advisory: OSV:GHSA-724G-MXRG-4QVM...

NPM: js-yaml: Quadratic-complexity (O(n^2)) DoS via !!omap tag in YAML11_SCHEMA

NPM: js-yaml: Quadratic-complexity On^2 DoS via !!omap tag in YAML11SCHEMA vulnerability discovered by ? in WordPress Npm js-yaml versions = 5.0.0, = 5.2.0...

@algolia/coquille (>=0.0.2, <=0.0.13), @candlelabs/sdk (>=1.0.1, <=1.0.2) +28 more potentially affected by CVE-2026-13149 via brace-expansion (>=1.1.0, <=1.1.13)

brace-expansion NPM version =1.1.0, =0.0.2, =1.0.1, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =2.9.6-canary.2, =0.0.3, =0.1.0 and more Source cves: CVE-2026-13149 Source advisory: OSV:GHSA-3JXR-9VMJ-R5CP...

MAL-2026-10929 Malicious code in trongrider (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0766a0a8222cb9a7a188ad8c88daf73b102036079be073f01661cde1622b99b5 The package exposes a function permprivatekey that POSTs the caller-supplied TRON private key as JSON to the hardcoded URL...

Updated golang packages fix security vulnerabilities

The updated packages fix security vulnerabilities: mime: quadratic complexity in WordDecoder.DecodeHeader. CVE-2026-42504 net/textproto: arbitrary input are included in errors without any escaping. CVE-2026-42507 crypto/x509: split candidate hostname only once. CVE-2026-27145 os: Root escape via...

MGASA-2026-0274 Updated php packages fix a security vulnerability

The updated php packages fix a security issue: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD. CVE-2026-14355...

MGASA-2026-0281 Updated python-nltk packages fix security vulnerability

URL-Encoded Path Traversal in nltk.data.load Allows Arbitrary Local File Read. CVE-2026-54293...

@0xjwlabs/discord-rpc (0.1.0), @0xsquid/react-hooks (>=1.0.0, <=2.0.0) +1568 more potentially affected by CVE-2026-67313 via axios (>=0.28.0, <=0.32.0)

axios NPM version =0.28.0, =1.0.0, =3.0.0-beta.0, =2.10.1, =1.0.0, =1.0.0, =0.1.0, =0.0.1, =0.0.2, =1.3.2, =1.4.13, =13.0.0, =16.5.4 and more Source cves: CVE-2026-67313 Source advisory: SNYK:JS-AXIOS-18060167...

Malicious code in automatic-octo-invention (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2dfb4e3eedab24e355b6d24db6096e6752563e220d28e83ad2cf213fe49fd89 The package ships an 8.6 MB stripped ELF binary at automaticoctoinvention/claw sha256 f6fe45f8fe9081987505af31f0249021a65b558af514f2e4e37340fb3182805...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: busybox: busybox-1.37.0-8.2.hum1 aarch64, x8664 busybox-petitboot-1.37.0-8.2.hum1 aarch64, x8664 busybox-shared-1.37.0-8.2.hum1 aarch64, x8664 busybox-1.37.0-8.2.hum1.src src Security Fixes:...

Malicious code in nemopush (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58d2958d0307dfe5b73dc1eef5a46e96c25f94ea31a0b4ab8b43a1878d427d2d The package advertises itself as 'A push notification package' but ships an 8.6 MB opaque ELF x86-64 binary named claude and a start.sh wrapper as...

Amazon Linux 2023 : golang-github-burntsushi-toml-test, golang-github-burntsushi-toml-test-devel (ALAS2023-2026-1977)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1977 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

MAL-2026-10934 Malicious code in twilio-internal (npm)

The twilio-internal package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution against ...

Linux Distros Unpatched Vulnerability : CVE-2026-64066

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfs: Fix netfsreadtopagecache to pause on subreq failure Fix netfsreadtopagecache so that it pauses the generation of new subrequests if an already-issued...

Linux Distros Unpatched Vulnerability : CVE-2026-64068

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfs: Fix missing locking around retry adding new subreqs Fix netfsretryreadsubrequests and netfsretrywritestream to take the appropriate lock when adding extr...

Linux Distros Unpatched Vulnerability : CVE-2026-64072

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: nvme: fix bio leak on mapping failure The local bio is always NULL, so we'd leak the bio if...

Linux Distros Unpatched Vulnerability : CVE-2026-63840

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v5.3.0 ring JPEG rings do not support 64-bit user...