Malicious code in private-packages-sharingsession (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7350 Malicious code in private-packages-sharing-sessionz (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @gpbw-fcop-ui-packages/theme (npm)

--- -= Per source details. Do not edit below this line.=-...

Linux Distros Unpatched Vulnerability : CVE-2026-54433

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting XSS via a crafted plain-text email message. The...

AlmaLinux 8 : libreoffice (ALSA-2026:35839)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:35839 advisory. libreoffice: LibreOffice Calc: Arbitrary code execution via heap buffer overflow in formula compilation CVE-2026-8357 Tenable has extracted the preceding...

20mk-utils (>=1.0.0, <=1.0.3), 2d-spirograph (>=1.0.2, <=1.0.4) +2119 more potentially affected by CVE-2026-59711 via showdown (>=0.0.1, <=2.1.0)

showdown NPM version =0.0.1, =1.0.0, =1.0.2, =2.0.4, =1.0.6, =0.1.4, =0.1.4, =0.1.4, =13.351.0, =13.351.0, =7.10.0, =7.10.0, =0.0.3, =0.5.1 - @adalink/spark-chat 1.0.0 and more Source cves: CVE-2026-59711 Source advisory: SNYK:JS-SHOWDOWN-17874448...

-llscw-react-cli (>=1.0.0, <=1.1.0), 002-node-cli (1.0.0) +21936 more potentially affected by CVE-2026-53486 via decompress (>=4.0.0, <=4.2.1)

decompress NPM version =4.0.0, =1.0.0, =0.0.1, =1.0.0, =2.2.0-alpha.3 and more Source cves: CVE-2026-53486 Source advisory: OSV:GHSA-MP2F-45PM-3CG9...

CVE-2026-50021

A flaw was found in pnpm, a package manager. An attacker who can modify the pnpm-lock.yaml file and control the package registry can exploit this vulnerability. By removing the integrity field from the lockfile and serving altered package content, the pnpm install --frozen-lockfile command can...

CVE-2026-50016

A flaw was found in pnpm, a package manager. This vulnerability allows a malicious registry package to include specially crafted dependency aliases that contain path traversal segments. During the installation process, pnpm incorrectly processes these aliases, which can lead to the replacement of...

RHSA-2026:35812 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

RHSA-2026:35807 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

-react-file-list-components (1.1.1), -tompan-reacttemplate (>=1.0.1, <=1.1.0) +41044 more potentially affected by CVE-2026-14802 via react-dev-utils (>=0.1.1, <=12.1.0-next.26)

react-dev-utils NPM version =0.1.1, =1.0.1, =0.1.0, =0.1.0, =0.1.6 - 0beny1s 1.1.6 - 0scarclassa 1.0.1 - 0scarclassb 1.0.1 - 0scarclassc 1.0.1 - 0scarclassd 1.0.1 - 0scarclasse 1.0.1 - 0scarclassf 1.0.1 - 0scarclassg 1.0.1 - 0scarclassh 1.0.1 - 0scarclassi 1.0.1 and more Source cves: CVE-2026-148...

RockyLinux 10 : cifs-utils (RLSA-2026:32990)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:32990 advisory. cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall CVE-2026-12505 Tenable has extracted the preceding description bloc...

MiracleLinux 8 : glibc-2.28-251.el8_10.38 (AXSA:2026-1182:06)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1182:06 advisory. glibc: glibc: Heap Buffer Overflow in scanf with %mc format specifier and large width CVE-2026-5450 Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-11819

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Module: plugins/modules/keyringinfo.py CVSS 3.1: 5.5 MEDIUM AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Issue: The module retrieves a passphrase from the OS native...

RockyLinux 10 : coreutils (RLSA-2026:33124)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:33124 advisory. coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification CVE-2025-5278 Tenable has extracted the preceding description block directly from...

MiracleLinux 9 : bind-9.16.23-40.el9_8.1 (AXSA:2026-1031:06)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1031:06 advisory. bind: Resource exhaustion via malformed DNSKEY handling CVE-2025-8677 Tenable has extracted the preceding description block directly from the MiracleLinux...

[SECURITY] [DSA 6381-1] linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6381-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 05, 2026 https://www.debian.org/security/faq -...

MGASA-2026-0235 Updated mariadb packages fix security vulnerabilities

This update to the latest LTS version fixes some severe security vulnerabilities...

North Korean Hackers Publish 108 Malicious Packages and Extensions in PolinRider Campaign

The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing 108 unique packages and web browser extensions spanning npm, Packagist, Go, and Google Chrome as part of an ongoing activity referred to as PolinRider. "The campaign remains active, and new...