Oracle Linux 10 : plexus-utils (ELSA-2026-38514)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-38514 advisory. 3.5.1-9 - Fix CVE-2025-67030: Directory Traversal in Expand.extractFile Resolves: RHEL-165336 Tenable has extracted the preceding description block directly...

CVE-2026-46681: Improperly Controlled Modification of Object Prototype Attributes

@nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys proto,...

MAL-2026-11001 Malicious code in date-format-utils-xz (npm)

The npm package date-format-utils-xz masquerades as a date-formatting utility but is malicious. Its own decoy index.js is prefaced with a Chinese comment translating to "disguised as a normal date formatting tool." Every published version 1.0.0-1.0.4 declares a postinstall lifecycle hook...

Malicious code in date-format-utils-xz (npm)

The npm package date-format-utils-xz masquerades as a date-formatting utility but is malicious. Its own decoy index.js is prefaced with a Chinese comment translating to "disguised as a normal date formatting tool." Every published version 1.0.0-1.0.4 declares a postinstall lifecycle hook...

Oracle Linux 9 : plexus-utils (ELSA-2026-38796)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-38796 advisory. 3.3.0-14 - Fix CVE-2025-67030: Directory Traversal in Expand.extractFile Resolves: RHEL-165350 Tenable has extracted the preceding description block directly...

MGASA-2026-0280 Updated nilfs-utils packages fix security vulnerability

Undefined Behavior and Out-of-Memory via Unvalidated slogblocksize. CVE-2026-55392...

Updated nilfs-utils packages fix security vulnerability

Undefined Behavior and Out-of-Memory via Unvalidated slogblocksize. CVE-2026-55392...

RLSA-2026:41948 Important: javapackages-tools:201801 security update

The javapackages-tools packages provide macros and scripts to support Java packaging. Security Fixes: org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2025-67030 For more details about the security issues, including the impact, a CVSS score,...

org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method

A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the extractFile method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user...

MAL-2026-10905 Malicious code in win-build-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03bd3facc00c36861223058a572fbaa888d815a06c7b309c44639c544c65f1d9 The package name suggests a Windows build helper utility, but no concrete behavioral evidence is available to confirm or refute installer-side risk. ...

MAL-2026-10889 Malicious code in @public-for-cdao/utils (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in @public-for-cdao/utils (npm)

--- -= Per source details. Do not edit below this line.=-...

RHEL 8 : javapackages-tools:201801 (RHSA-2026:41948)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:41948 advisory. The javapackages-tools packages provide macros and scripts to support Java packaging. Security Fixes: org.codehaus.plexus:plexus-utils: Plexus-utils...

RockyLinux 8 : javapackages-tools:201801 (RLSA-2026:41948)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:41948 advisory. org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2025-67030 Tenable has extracted the preceding description block...

MAL-2026-10954 Malicious code in @markscan/utils (npm)

The @markscan/utils package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms ...

AlmaLinux 8 : maven:3.8 (ALSA-2026:40841)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:40841 advisory. org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2025-67030 Tenable has extracted the preceding description block...

Important: javapackages-tools:201801 security update

The javapackages-tools packages provide macros and scripts to support Java packaging. Security Fixes: org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVE-2025-67030 For more details about the security issues, including the impact, a CVSS score,...

plexus-utils security update

3.3.0-14 - Fix CVE-2025-67030: Directory Traversal in Expand.extractFile Resolves: RHEL-165350...

OESA-2026-3029 cifs-utils security update

The in-kernel CIFS filesystem is generally the preferred method for mounting SMB/CIFS shares on Linux. Security Fixes: A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in...

OESA-2026-3031 cifs-utils security update

The in-kernel CIFS filesystem is generally the preferred method for mounting SMB/CIFS shares on Linux. Security Fixes: A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in...