CVE-2024-44219

CVE-2024-44219 affects macOS Sequoia (15.1) where a permissions issue could allow a malicious application with root privileges to access private information. Public documents confirm the flaw and its fix in Sequoia 15.1; remediation is to upgrade to macOS 15.1 or later. The exact root cause is de...

CVE-2024-44219

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. A malicious application with root privileges may be able to access private information...

CVE-2026-33903

Ella Core (private 5G core) is affected by CVE-2026-33903. Versions prior to 1.7.0 panic when processing a specially crafted NGAP LocationReport message, allowing an attacker to crash the process and cause service disruption for all connected subscribers. The fix is included in version 1.7.0, whi...

Malicious code in chai-as-added (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 121a09e21b10c98f705a02343e235a9800c57b33a81abf364a47c3af69b6ceb4 The package chai-as-added was found to contain malicious code. Source: ghsa-malware 8d5056d792b6ced90bb9fe5c9ebd1726cc6bd61554739bb67c933cf4f7f50840...

Malicious Package

Overview chai-as-added is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-2249 Malicious code in chai-as-added (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 121a09e21b10c98f705a02343e235a9800c57b33a81abf364a47c3af69b6ceb4 The package chai-as-added was found to contain malicious code. Source: ghsa-malware 8d5056d792b6ced90bb9fe5c9ebd1726cc6bd61554739bb67c933cf4f7f50840...

CVE-2026-28870

An information leakage was addressed with additional validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to access sensitive user data...

CVE-2026-28863

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.4 and iPadOS 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. An app may be able to fingerprint the user...

CVE-2026-20697

CVE-2026-20697 describes a permissions-related issue in macOS that could allow an app to access sensitive user data. The vulnerability is addressed by Apple in the following fixed product versions: macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4. The public advisories indicate the...

PT-2026-27600

A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4. An app may be able to enumerate a user's installed apps...

CVE-2026-33283 Ella Core panics on malformed ULNASTransport Message without a Request Type

Ella Core is a 5G core designed for private networks. Versions prior to 1.6.0 panic when processing malformed UL NAS Transport NAS messages without a Request Type. An attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all connected...

CLSA-2026-1774279106 Update of alt-php

Update ca-certificates database to 20260303: - mozilla\certdata.h,nssckbi.h: Update Mozilla certificate authority bundle of the version 2.84. - The following certificates were updated: Certificate "GlobalSign Root CA" Certificate "Entrust.net Premium 2048 Secure Server CA" Certificate "Comodo AAA...

PT-2026-26467

Name of the Vulnerable Software and Affected Versions Ella Core versions prior to 1.6.0 Description Ella Core, a 5G core designed for private networks, experiences a panic when processing NGAP messages containing invalid PDU Session IDs outside the range of 1-15. An attacker capable of sending...

PT-2026-26024

Kanboard is project management software focused on Kanban methodology. Versions prior to 1.2.51 have an authenticated SQL injection vulnerability. Attackers with the permission to add users to a project can leverage this vulnerability to dump the entirety of the kanboard database. Version 1.2.51...

CLSA-2026-1773684091 Update of ca-certificates

update to CKBI 2.84 from NSS 3.121 - updated certificates: - Certificate "ePKI Root Certification Authority" - Certificate "GlobalSign Root CA" - Certificate "Entrust.net Premium 2048 Secure Server CA" - Certificate "Comodo AAA Services root" - Certificate "XRamp Global CA Root" - Certificate "Go...

Denial of service in Quinn endpoints

Receiving QUIC transport parameters containing invalid values could lead to a panic. Unfortunately the maintainers did not properly assess usage of unwrap calls in the transport parameters parsing code, and we did not have sufficient fuzzing coverage to find this issue. We have since added a...

SUSE SLES16 Security Update : podman (SUSE-SU-2026:20626-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:20626-1 advisory. Changes in podman: - Add symlink to catatonit in /usr/libexec/podman bsc1248988 - CVE-2025-47914: Fixed...

CLSA-2026-1772643333 Update of nss

update to CKBI 2.82 from NSS 3.120 - updated certificates: - Certificate "ePKI Root Certification Authority" - Certificate "GlobalSign Root CA" - Certificate "Entrust.net Premium 2048 Secure Server CA" - Certificate "Comodo AAA Services root" - Certificate "XRamp Global CA Root" - Certificate "Go...

CVE-2026-23235

CVE-2026-23235 (Linux kernel, f2fs) is a local, in-kernel vulnerability where certain f2fs sysfs attributes permit out-of-bounds memory access and misinterpretation of integer sizes. The root causes are: __sbi_store() and f2fs_sbi_show() incorrectly treat all default values as unsigned int, causi...

SUSE-SU-2026:20652-1 Security update for ca-certificates-mozilla

This update for ca-certificates-mozilla fixes the following issues: - Updated to 2.84 state of Mozilla SSL root CAs bsc1258002 - Removed: - Baltimore CyberTrust Root - CommScope Public Trust ECC Root-01 - CommScope Public Trust ECC Root-02 - CommScope Public Trust RSA Root-01 - CommScope Public...