RLSA-2026:98613 Critical: cockpit-image-builder security update

The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild. Security Fixes: source-map-js: source-map-js: Denial of Service via malformed indexed source maps CVE-2026-93749 brace-expansion:...

cockpit-image-builder security update

An update is available for cockpit-image-builder. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The image-builder-frontend generates custom images suitable fo...

No title provided

A flaw was found in zod. A remote attacker can trigger a denial of service DoS by submitting an excessively large array of invalid items to an application that validates input schemas without length constraints. Because the validation process accumulates error records for each failing element...

Critical: Red Hat Security Advisory: cockpit-image-builder security update

An update for cockpit-image-builder is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RHEL 10 : cockpit-image-builder (RHSA-2026:98613)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:98613 advisory. The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as...

ROOT-APP-NPM-CVE-2023-54404 CVE-2023-54404 in zod - Patched by Root

Root has patched CVE-2023-54404 in the zod package for Root:npm. Multiple fixed versions available...

CLSA-2026-1793241749 TuxCare security update for zod (1 CVE)

TuxCare rebuilt zod to address 1 CVE. Fixed in 3.25.67-tuxcare.1...

CLSA-2026-1793241599 TuxCare security update for zod (1 CVE)

TuxCare rebuilt zod to address 1 CVE. Fixed in 3.25.75-tuxcare.1...

CLSA-2026-1793241442 TuxCare security update for zod (1 CVE)

TuxCare rebuilt zod to address 1 CVE. Fixed in 3.25.48-tuxcare.1...

PT-2026-139922

TuxCare rebuilt zod to address 1 CVE. Fixed in 3.25.75-tuxcare.1...

PT-2026-139923

TuxCare rebuilt zod to address 1 CVE. Fixed in 3.25.67-tuxcare.1...

PT-2026-139921

TuxCare rebuilt zod to address 1 CVE. Fixed in 3.25.48-tuxcare.1...

CLSA-2026-1793221310 TuxCare security update for zod (1 CVE)

TuxCare rebuilt zod to address 1 CVE. Fixed in 3.21.4-tuxcare.2...

Zod Can Exhaust Memory While Validating Oversized Constrained Collections

Zod schema-validation library through 4.6.5 contains an uncontrolled resource consumption vulnerability that allows attackers to exhaust memory by submitting a large array to an application using an array schema without a length constraint. Attackers can exploit the handleArrayResult parse logic ...

Security Bulletin: IBM Test Accelerator for Z uses zod-4.4.3.tgz which is vulnerable to CVE-2023-54404

Summary Security Bulletin: IBM Test Accelerator for Z uses zod-4.4.3.tgz which is vulnerable to CVE-2023-54404. This security bulletin provides details about the vulnerability and the corresponding remediation. Vulnerability Details CVEID:CVE-2023-54404 DESCRIPTION: Zod schema-validation library...

@orpc/zod: Prototype injection in smart coercion

Summary ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin mishandle object keys that name Object.prototype members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can: 1. replace the prototype of...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via the zodCoerceInternal function in coercer.ts Zod 3 and the coerce method in zod4/coercer.ts Zod 4, which are used by ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin respectively. Both plugins coerce...

GHSA-GCGF-FH7C-8GF2 @orpc/zod: Prototype injection in smart coercion

Summary ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin mishandle object keys that name Object.prototype members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can: 1. replace the prototype of...

EUVD-2026-91793

@orpc/zod: Prototype injection in smart coercion...

CVE-2026-103918

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...