@backstage/plugin-auth-backend (>=0.0.0-nightly-20240122021809, <=0.22.11), @backstage/plugin-auth-backend-module-aws-alb-provider (>=0.0.0-nightly-20240126021148, <=0.4.13-next.1) +11 more potentially affected by CVE-2026-32236 via @backstage/plugin-auth-backend (>=0.0.0-nightly-20240929023448, <=0.27.0-next.1)

@backstage/plugin-auth-backend NPM version =0.0.0-nightly-20240929023448, =0.0.0-nightly-20240122021809, =0.0.0-nightly-20240126021148, =0.0.0-nightly-20240122021809, =0.0.0-nightly-202201422556, =0.0.0-nightly-202111222339, =0.0.0-nightly-2021102522541, =0.0.0-nightly-20220203021748, =1.0.0,...

@saasmakers/ui (>=0.1.88, <=1.4.50), @styleframe/docs (>=1.1.0, <=2.0.1) +12 more potentially affected by CVE-2026-31873 via unhead (>=2.0.0, <=2.1.10)

unhead NPM version =2.0.0, =0.1.88, =1.1.0, =2.0.0-alpha.19, =2.0.0-alpha.9, =2.0.0-alpha.0, =2.0.0-alpha.18, =2.0.0-alpha.17, =2.0.0-alpha.0, =1.2.0, =0.0.2, =0.17.0, =2.0.0-alpha.8, =0.1.0-beta.10, =0.1.0-beta.14 Source cves: CVE-2026-31873 Source advisory: OSV:GHSA-5339-HVWR-7582...

@saasmakers/ui (>=0.1.88, <=1.4.50), @styleframe/docs (>=1.1.0, <=2.0.1) +12 more potentially affected by CVE-2026-31860 via unhead (>=2.0.0, <=2.1.10)

unhead NPM version =2.0.0, =0.1.88, =1.1.0, =2.0.0-alpha.19, =2.0.0-alpha.9, =2.0.0-alpha.0, =2.0.0-alpha.18, =2.0.0-alpha.17, =2.0.0-alpha.0, =1.2.0, =0.0.2, =0.17.0, =2.0.0-alpha.8, =0.1.0-beta.10, =0.1.0-beta.14 Source cves: CVE-2026-31860 Source advisory: OSV:GHSA-G5XX-PWRP-G3FV...

GHSA-6XVM-J4WR-6V98 vulnerabilities

Vulnerabilities for packages: vector, wadm, berg, nushell, wasmcloud, uv, cargo-audit, lychee, py3-xet-core, xh, parseable, wash, zed, zola, sccache, samply, zizmor, pixi, qdrant...

Malicious Package

Overview libsignal-mod is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Linux Distros Unpatched Vulnerability : CVE-2026-3929

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Side-channel information leakage in ResourceTiming in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to leak cross-origin data via a crafted HTM...

Moderate Photon OS Security Update - PHSA-2026-5.0-0784

Updates of 'mariadb' packages of Photon OS have been released...

Linux Distros Unpatched Vulnerability : CVE-2026-3927

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect security UI in PictureInPicture in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-3916

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read in Web Speech in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML...

Linux Distros Unpatched Vulnerability : CVE-2026-3935

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect security UI in WebAppInstalls in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromi...

Linux Distros Unpatched Vulnerability : CVE-2026-3915

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Heap buffer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page...

Linux Distros Unpatched Vulnerability : CVE-2026-3939

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient policy enforcement in PDF in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to bypass navigation restrictions via a crafted PDF fil...

Linux Distros Unpatched Vulnerability : CVE-2026-3925

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect security UI in LookalikeChecks in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to perform UI spoofing via a crafted HTML...

MiracleLinux 8 : nfs-utils-2.3.3-68.el8_10 (AXSA:2026-284:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-284:01 advisory. nfs-utils: rpc.mountd in the nfs-utils privilege escalation CVE-2025-12801 Tenable has extracted the preceding description block directly from the MiracleLinu...

Linux Distros Unpatched Vulnerability : CVE-2026-3938

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient policy enforcement in Clipboard in Google Chrome prior to 146.0.7680.71 allowed a remote attacker who had compromised the renderer process to leak...

Linux Distros Unpatched Vulnerability : CVE-2026-3936

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in WebView in Google Chrome on Android prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML...

Important Photon OS Security Update - PHSA-2026-4.0-0977

Updates of 'linux', 'curl' packages of Photon OS have been released...

Photon OS 4.0: Ruby PHSA-2026-4.0-0976

An update of the ruby package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-4.0-0976. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2026-30239

OpenProject is an open-source, web-based project management software. Prior to 17.2.0, when budgets are deleted, the work packages that were assigned to this budget need to be moved to a different budget. This action was performed before the permission check on the delete action was executed. Thi...

CVE-2026-31839

Summary of CVE-2026-31839 (Striae) : A high-severity integrity bypass existed in Striae’s digital confirmation workflow prior to v3.0.0. Hash-only validation could be bypassed because trusted manifest hash fields could be modified alongside package content, allowing tampered confirmation packages...