CLSA-2026-1774830269 TuxCare security update for loader-utils (3 CVEs)

TuxCare rebuilt loader-utils to address 3 CVEs. Fixed in 2.0.0-tuxcare.1...

CLSA-2026-1774830262 TuxCare security update for loader-utils (3 CVEs)

TuxCare rebuilt loader-utils to address 3 CVEs. Fixed in 1.2.3-tuxcare.1...

CLSA-2026-1773447386 TuxCare security update for loader-utils (1 CVE)

TuxCare rebuilt loader-utils to address 1 CVE. Fixed in 0.2.17-tuxcare.1...

Malicious code in @servicetitan/anvil-css-utilities (npm)

npm/@servicetitan/anvil-css-utilities is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...

MAL-2026-11815 Malicious code in @servicetitan/anvil-css-utilities (npm)

npm/@servicetitan/anvil-css-utilities is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...

Malicious code in @cacheable/utils (npm)

npm/@cacheable/utils version 2.5.1 is a trojanized release published on 2026-08-04 during the compromise of the npm/GitHub maintainer account behind the keyv and cacheable package families user "Jaredwray". Attackers pushed the malicious payload to the source repository and cut releases through...

RHEL 9 : sg3_utils (RHSA-2026:50141)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:50141 advisory. The sg3utils packages provide command-line utilities for devices that use the Small Computer System Interface SCSI command sets. Security Fixes:...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Malicious Package

Overview lifestyle-test-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the readBlock method of PGPAeadInputStream BcAEADUtil, mirrored in JceAEADUtil, which pre-reads the final 16 bytes but ignores the result and returns EOF without calling doFinal when the...

io.github.compyoot:utilities-and-generic-tools (0.3.11), org.scala-sbt.ivy:ivy (>=2.3.0-sbt-a8f9eb5bf09d0539ea3658a2c2d4e09755b5133e, <=2.3.0-sbt-5681e1a77a149b93a4cfbe4a86d0263d7bd223eb) potentially affected by CVE-2026-12817 via org.bouncycastle:bcpg-jdk14 (1.45)

org.bouncycastle:bcpg-jdk14 MAVEN version 1.45 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-jdk14 and may be impacted: - io.github.compyoot:utilities-and-generic-tools 0.3.11 - org.scala-sbt.ivy:ivy...

io.github.compyoot:utilities-and-generic-tools (0.3.11), org.scala-sbt.ivy:ivy (>=2.3.0-sbt-a8f9eb5bf09d0539ea3658a2c2d4e09755b5133e, <=2.3.0-sbt-5681e1a77a149b93a4cfbe4a86d0263d7bd223eb) potentially affected by CVE-2026-59640 via org.bouncycastle:bcpg-jdk14 (1.45)

org.bouncycastle:bcpg-jdk14 MAVEN version 1.45 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-jdk14 and may be impacted: - io.github.compyoot:utilities-and-generic-tools 0.3.11 - org.scala-sbt.ivy:ivy...

io.github.compyoot:utilities-and-generic-tools (0.3.11), org.scala-sbt.ivy:ivy (>=2.3.0-sbt-a8f9eb5bf09d0539ea3658a2c2d4e09755b5133e, <=2.3.0-sbt-5681e1a77a149b93a4cfbe4a86d0263d7bd223eb) potentially affected by CVE-2026-59649 via org.bouncycastle:bcpg-jdk14 (1.45)

org.bouncycastle:bcpg-jdk14 MAVEN version 1.45 is affected by a known vulnerability. The following packages have a transitive dependency on org.bouncycastle:bcpg-jdk14 and may be impacted: - io.github.compyoot:utilities-and-generic-tools 0.3.11 - org.scala-sbt.ivy:ivy...

keras-utilities (>=0.1.7, <=0.1.27) potentially affected by CVE-2026-9335 via keras (1.2.1)

keras PYPI version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-utilities =0.1.7, =0.1.27 Source cves: CVE-2026-9335 Source advisory: OSV:GHSA-M8WH-29WM-52MV...

@a-rt-works/auth0-deploy-cli (3.3.3), @acknow-srl/express-openid (>=1.0.0, <=1.0.1) +536 more potentially affected by CVE-2026-67321 via axios (>=0.31.1, <=0.32.0)

axios NPM version =0.31.1, =1.0.0, =0.0.1, =0.0.2, =1.3.2, =0.2.0, =0.0.2-beta.0, =2.0.14, =0.5.12, =1.0.0, =1.0.1, =32.0.0, =0.2.4, =0.3.0 and more Source cves: CVE-2026-67321 Source advisory: MEND:CVE-2026-67321...

cJSON Utils Heap Buffer Overflow

The vulnerability of the applypatch function in the cJSONUtils.c component of the C language JSON object handling library is related to an incorrect implementation of the sequence of actions to be performed. Exploiting this vulnerability could allow a remote attacker to compromise data integrity...

Malicious code in @solana-utils/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware abda158dfd80788df38b2221a5a9715eb7d6bebadb9569cfc51774985f39b0fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview @solana-utils/common is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

A Leaked Memo Ties Cyberattacks on Minnesota Water Utilities to Iran

A memo obtained by WIRED, issued by the water utilities information sharing group WaterISAC, links dozens of cyberattacks against Minnesota water utilities to Tehran...

plexus-utils security update

An update is available for plexus-utils. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Plexus project seeks to create end-to-end developer tools for writin...