CVE-2026-63071

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

CVE-2026-63071 Apache Syncope: RCE via Groovy Sandbox bypass

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

EUVD-2026-45955

Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through...

Malicious code in neroteam-v1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8a87642ea3c7a291704b2306a242bb496048571efcafb63835055f0871aed19 Importing the nero package triggers nero/init.py to load nero.main, whose top-level code runs a guard routine before executing a hidden payload. guar...

MAL-2026-10868 Malicious code in neroteam-v1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8a87642ea3c7a291704b2306a242bb496048571efcafb63835055f0871aed19 Importing the nero package triggers nero/init.py to load nero.main, whose top-level code runs a guard routine before executing a hidden payload. guar...

Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript execution in PDF.js CVE-2024-4367 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash CVE-2026-39872 webkitgtk: webkitgtk:...

PT-2026-61723

Name of the Vulnerable Software and Affected Versions @ai-sdk/harness-opencode versions prior to 1.0.28 Description The tool connects HarnessAgent to OpenCode via a sandboxed bridge. The tool relay authorizes requests from any process whose command line contains the allowed helper script path...

PT-2026-61603

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.6 Apache Syncope versions 4.1.0-M0 through 4.1.1 Description An improper isolation issue allows an administrator with sufficient entitlements to impor...

ALSA-2026:42062 Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript execution in PDF.js CVE-2024-4367 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash CVE-2026-39872 webkitgtk: webkitgtk:...

ALSA-2026:42088 Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript execution in PDF.js CVE-2024-4367 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash CVE-2026-39872 webkitgtk: webkitgtk:...

PT-2026-61604

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.6 Apache Syncope versions 4.1.0-M0 through 4.1.1 Description Improper isolation or compartmentalization in the connector subsystem allows an...

PT-2026-61610

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.6 Apache Syncope versions 4.1.0-M0 through 4.1.1 Description Improper isolation or compartmentalization allows an administrator with entitlements for...

Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript execution in PDF.js CVE-2024-4367 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash CVE-2026-39872 webkitgtk: webkitgtk:...

RHEL 9 : webkit2gtk3 (RHSA-2026:42062)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42062 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript...

RHEL 8 : webkit2gtk3 (RHSA-2026:42088)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42088 advisory. WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript...

MAL-2026-10780 Malicious code in data-parser-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e63ddac8a229de35d497a342d918dbf4255d76e932db5ac33f1cf7db1a9e1939 The package's advertised parsexml/parsejson functions invoke an internal checkenvironment routine that, after a host-uptime sandbox-evasion gate 300...

Malicious code in data-parser-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e63ddac8a229de35d497a342d918dbf4255d76e932db5ac33f1cf7db1a9e1939 The package's advertised parsexml/parsejson functions invoke an internal checkenvironment routine that, after a host-uptime sandbox-evasion gate 300...

OESA-2026-3053 yelp security update

Yelp is the help viewer in GNOME. It natively views Mallard, DocBook, man, info, and HTML documents. It can locate documents according to the freedesktop.org help system specification. Security Fixes: A flaw was found in Yelp due to an overly permissive Content Security Policy CSP implementation...

MiracleLinux 9 : flatpak-1.12.9-4.el9_8.1 (AXSA:2026-1286:03)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1286:03 advisory. flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options CVE-2026-34078 flatpak: Flatpak: Arbitrary file deletion o...

PT-2026-61059

A Time-of-check Time-of-use TOCTOU Race Condition vulnerability in seunshare of selinux policycoreutils allows a user calling seunshare that is running in the unconfined SELinux domain to delete arbitrary root-owned files, This issue affects policycoreutils through 3.10...