ROOT-APP-NPM-CVE-2025-59471 CVE-2025-59471 in next - Patched by Root

Root has patched CVE-2025-59471 in the next package for Root:npm. Multiple fixed versions available...

GO-2025-3774 vulnerabilities

Vulnerabilities for packages: argo-cd, node-feature-discovery-fips, vcluster, rancher, blob-csi-fips, rancher-fleet, rancher-system-agent, cloud-provider-gcp-cloud-controller-manager, yunikorn-k8shim-fips, azurefile-csi-fips, cluster-autoscaler, longhorn-share-manager-fips, cluster-autoscaler-fip...

EUVD-2026-58135

Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint...

CVE-2026-17572 affecting package hdf5 for versions less than 1.14.6-4

CVE-2026-17572 affecting package hdf5 for versions less than 1.14.6-4. A patched version of the package is available...

ROOT-OS-DEBIAN-11-CVE-2024-38556 CVE-2024-38556 in linux - Patched by Root

Root has patched CVE-2024-38556 in the linux package for Root:Debian:11. Multiple fixed versions available...

ae.vigilancer.android-run-app:ae.vigilancer.android-run-app.gradle.plugin (>=1.0.1, <=1.0.2), aero.m-click:mcpdf (>=0.2.3, <=0.2.10) +30477 more potentially affected by CVE-2026-8763 via org.bouncycastle:bcprov-jdk15on (>=1.46, <=1.70)

org.bouncycastle:bcprov-jdk15on MAVEN version =1.46, =1.0.1, =0.2.3, =4.4.0.0, =0.42.1, =0.1.12, =0.1.2, =0.28.0, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.1, =1.4.3 and more Source cves: CVE-2026-8763 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18512782...

MiracleLinux 8 : perl-IO-Compress-2.081-2.el8_10 (AXSA:2026-1105:01)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1105:01 advisory. perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob CVE-2026-48962 Tenable has extracted the preceding descripti...

Linux Distros Unpatched Vulnerability : CVE-2026-8804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Puppet resourceapi shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x does not preserve the sensitive flag on parameters defined via the...

Fedora 44 : perl-Socket (2026-91d6cb99f7)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-91d6cb99f7 advisory. 2.041- BUGFIXES - Fix reuse of STRLEN len variable in packipmreqsource Tenable has extracted the preceding description block directly from the Fedora securit...

Fedora 44 : singularity-ce (2026-63ae478575)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-63ae478575 advisory. Upgrade to 4.4.2 upstream version. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessu...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

Embedded Malicious Code

Overview @jagreehal/workflow is a Typed async workflows with automatic error inference. Build type-safe workflows with Result types, step caching, resume state, and human-in-the-loop support. Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

Cross-site Scripting (XSS)

Overview vitest is a Next generation testing framework powered by Vite Affected versions of this package are vulnerable to Cross-site Scripting XSS via the otelCarrier query parameter being directly inserted into an inline script without sanitization. An attacker can execute arbitrary JavaScript ...

Fedora 42 : nano (2026-fbeaecb457)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fbeaecb457 advisory. fix CVE-2026-6842 and CVE-29026-6843 Resolves: CVE-2026-6842 Resolves: CVE-2026-6843 Resolves: rhbz2455127 Resolves: rhbz2455314 Tenable has extract...

Fedora 43 : lemonldap-ng (2026-38914f4e04)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-38914f4e04 advisory. Update to 2.22.3 https://projects.ow2.org/view/lemonldap-ng/lemonldap-ng-2-22-3-is-out/ Tenable has extracted the preceding description block directly from t...