@darka-software/text-design-qwik (>=0.0.137, <=0.0.139), @turnipxenon/pineapple (>=5.0.0-alpha.1, <=5.0.0-alpha.5) +1 more potentially affected by unknown CVE via @sveltejs/kit (>=2.49.0, <=2.49.5)

@sveltejs/kit NPM version =2.49.0, =0.0.137, =5.0.0-alpha.1, =1.12.2, =1.12.3 Source cves: unknown CVE Source advisory: SNYK:JS-SVELTEJSKIT-15322998...

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +8 more potentially affected by CVE-2026-25940 via jspdf (>=4.0.0, <=4.1.0)

jspdf NPM version =4.0.0, =1.0.8, =1.4.0-I18n-QM, =0.5.129, =0.112.0-79, =0.111.0-7, =0.111.0-7, =0.111.0-7, =4.4.0, =4.4.1 - svgedit 7.4.1 Source cves: CVE-2026-25940 Source advisory: SNYK:JS-JSPDF-15322684...

@firedesktop/react-portal-base (2.1.2), @imaginario27/air-ui-utils (>=1.0.8, <=1.0.9) +8 more potentially affected by CVE-2026-25755 via jspdf (>=4.0.0, <=4.1.0)

jspdf NPM version =4.0.0, =1.0.8, =1.4.0-I18n-QM, =0.5.129, =0.112.0-79, =0.111.0-7, =0.111.0-7, =0.111.0-7, =4.4.0, =4.4.1 - svgedit 7.4.1 Source cves: CVE-2026-25755 Source advisory: OSV:GHSA-9VJF-QC39-JPRP...

com.netflix.ndbench:ndbench-cli (>=0.3.12, <=0.7.4), com.netflix.ndbench:ndbench-geode-plugins (>=0.3.5, <=0.7.4) +35 more potentially affected by CVE-2026-2817 via org.springframework.data:spring-data-geode (>=1.0.0.incubating-release, <=2.7.18)

org.springframework.data:spring-data-geode MAVEN version =1.0.0.incubating-release, =0.3.12, =0.3.5, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =2.0.0.release, =3.0.0, =3.2.1...

RHSA-2026:2658 Red Hat Security Advisory: OpenShift Container Platform 4.16.57 packages and security update

Bulletin has no description...

Critical Photon OS Security Update - PHSA-2026-4.0-0965

Updates of 'linux' packages of Photon OS have been released...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-1438)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1438 advisory. A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary. CVE-2025-61732 Tenable has extracted the preceding description block directly from...

Low Photon OS Security Update - PHSA-2026-5.0-90-0767

Updates of 'glib' packages of Photon OS have been released...

Linux Distros Unpatched Vulnerability : CVE-2026-2649

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromi...

Debian dsa-6143 : libvpx-dev - security update

The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6143 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6143-1 [email protected] https://www.debian.org/security/...

Linux Distros Unpatched Vulnerability : CVE-2025-14009

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The unzipiter function in nltk/downloader.py uses...

Low Photon OS Security Update - PHSA-2026-5.0-91-0767

Updates of 'glib' packages of Photon OS have been released...

Low Photon OS Security Update - PHSA-2026-5.0-92-0767

Updates of 'glib' packages of Photon OS have been released...

@0x590fab/sdcor2 (>=4.2.1, <=4.4.0), @cenk1cenk2/renovate-config (>=2.2.33, <=2.3.94) +22 more potentially affected by CVE-2026-26996 via minimatch (>=6.0.0, <=6.2.0)

minimatch NPM version =6.0.0, =4.2.1, =2.2.33, =0.2.6-alpha-20230114225627-66f5d9eac, =0.1.7-alpha-20230114225627-66f5d9eac, =0.15.7-alpha-20230114225627-66f5d9eac, =0.1.0, =3.108.8--canary.1.4727068200.0, =0.0.0, =1.12.0, =1.0.0-beta.13, =0.36.6-0, =0.36.6-0, =0.39.3-0 - editorconfig 1.0.2 and...

Improper Control of Generation of Code ('Code Injection') in @tygo-van-den-hurk/slyde

Impact This is a remote code execution RCE vulnerability. Node.js automatically imports /.plugin.js,mjs files including those from nodemodules, so any malicious package with a .plugin.js file could execute arbitrary code when installed or required. All projects using this loading behavior are...

CVE-2025-14009

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The unzipiter function in nltk/downloader.py uses zipfile.extractall without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when...

PYSEC-2026-96

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The unzipiter function in nltk/downloader.py uses zipfile.extractall without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when...

DEBIAN-CVE-2025-14009

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The unzipiter function in nltk/downloader.py uses zipfile.extractall without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when...

UBUNTU-CVE-2025-14009

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The unzipiter function in nltk/downloader.py uses zipfile.extractall without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when...

CVE-2025-14009

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The unzipiter function in nltk/downloader.py uses zipfile.extractall without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when...