dredge-cargo v0.11.2

This is NOT a password manager. NOT a notes app. And definetely NOT a deep-sea benthic abberant specimen taxonomic provenance registry. But it does the first two better than either. Just kidding not really. Install • Quick Start • Features • The Link Command • Commands • How It Works • Security •...

CVE-2026-11976

MonsterInsights Pro updates 10.2.0 and 10.2.2 were distributed from the official update bucket and contain a malicious file, class-system-check.php, due to a compromised AWS S3 bucket. Three distinct variants were observed on 2026-06-11, all using the same AES-256-GCM key, indicating a single thr...

SUSE-SU-2026:23056-1 Security update for libssh

This update for libssh fixes the following issues: - CVE-2026-3731: denial of Service via out-of-bounds read in SFTP extension name handler bsc1259377. - CVE-2026-59843: denial of service via zero advertised channel packet size bsc1272164. - CVE-2026-59844: denial of service via oversized SFTP re...

PT-2026-68638

Name of the Vulnerable Software and Affected Versions MonsterInsights Pro versions 10.2.0 through 10.2.2 Description The official update distribution bucket monster-insights.s3.amazonaws.com was compromised, allowing a threat actor to maintain write access and iterate on a malicious payload. This...

PT-2026-68739

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.1.0 Description The GET handler at the endpoint /api/tenants/id/appointments/appointmentId fails to perform authorization checks. This allows any party with a valid appointment UUID to retrieve the full...

CVE-2026-48077: Missing Authorization

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at /api/tenants/id/appointments/appointmentId performs no authorization check before returning the appointment record. Any party who knows or obtains...

SUSE-SU-2026:3514-1 Security update for php8

This update for php8 fixes the following issues: Update to version 8.2.33. Security issues fixed: - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. - CVE-2026-9672: security issues in libgd bsc1273078. -...

Security update for php8

This update for php8 fixes the following issues: Update to version 8.2.33. Security issues fixed: CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. CVE-2026-9672: security issues in libgd bsc1273078. CVE-2026-17543:...

Malicious code in uzair-rajput-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b371d3a1e96e6e79066cf8f620a85867c73eb9ddbe68a81a33589e85146c4df6 The package is published as a chalk/tinygradient color-gradient wrapper, and its ESM entrypoint dist/index.js matches that description. The CJS main...

MAL-2026-13360 Malicious code in uzair-rajput-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b371d3a1e96e6e79066cf8f620a85867c73eb9ddbe68a81a33589e85146c4df6 The package is published as a chalk/tinygradient color-gradient wrapper, and its ESM entrypoint dist/index.js matches that description. The CJS main...

MAL-2026-12376 Malicious code in express-middle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91c0275a4e65fc4ed9930cb89002f2c4ebc50163b292f552703c4ea6a9940567 package.json declares postinstall: node index.js, which fires automatically on npm install. index.js is a heavily obfuscated bundle obfuscator.io-sty...

Malicious code in express-mongo-santi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85c97cf70eead9dda2069dc9da7e4a780f7c69953714ad050566c0e94a343e33 The package's main file index.js is a heavily obfuscated bundle obfuscator.io-style rotated string array with base64+RC4 decoders whose only purpose ...

CVE-2026-17578

Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate withou...

CVE-2026-17578 Kong Event Gateway AES-GCM nonce reuse due to missing key rotation enforcement

Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate withou...

Malicious code in dateuuidv2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a15649ce278832166c0fc4b80206329a54347bf748b207c088308e72a31f72f1 The package advertises itself as a UUID v7 generator, but its main entry loads lib/bootstrap.js which unconditionally invokes extractDateISO at requi...

PT-2026-68094

Name of the Vulnerable Software and Affected Versions Kong Event Gateway versions 1.0.0 through 1.1.1 Kong Event Gateway version 1.2.0 Description When the AWS IAM encryption feature is enabled, the software fails to enforce key rotation before reaching the NIST SP 800-38D recommended usage limit...

CVE-2026-17578: Reusing a Nonce, Key Pair in Encryption

Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption keys with random nonces when the AWS IAM encryption feature is enabled. If a producer sends messages at a sustained high rate withou...

MAL-2026-11993 Malicious code in @tuluax/errb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 561541f6fdbe9bd25716c6fb8a3326df9cbe7a78e7c972d89e36a1c9afc7a186 package.json scripts.install runs node -e "require'childprocess'.spawn'node', 'index.js', detached: true, stdio: 'ignore' .unref", causing npm instal...

CVE-2026-18759

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

Low: Red Hat Security Advisory: php8.4 security, bug fix, and enhancement update

An update for php8.4 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...