185 matches found
CentOS Linux 6 [TuxCare] Security Update: sendmail / sendmail-cf / sendmail-devel / sendmail-doc / etc (CENTOS6:CLSA-2026:1793168965)
The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1793168965 advisory. - ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible...
sendmail: Fix of CVE-2021-3618
CVE-2021-3618: HTTP commands accepted after STARTTLS ALPACA cross-protocol attack...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: nginx (UTSA-2026-091420)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-091420 advisory. ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as...
alpaca-farm (>=0.1.10, <=0.2.0) potentially affected by CVE-2026-69112 via accelerate (0.20.0)
accelerate PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - alpaca-farm =0.1.10, =0.2.0 Source cves: CVE-2026-69112 Source advisory: OSV:PYSEC-2026-3804...
Malicious code in effective-azure-alpaca (npm)
Source: amazon-inspector bcb50b92cf3b7559a46bb5aeac7e283712984a8db21877e606baa3d2afad05cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in constant-lime-alpaca (npm)
Source: amazon-inspector 80612f031df483c564f9aa4bc20938e434e0f663fab74bfa57d9f28719e8fcf5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in compact-indigo-alpaca (npm)
Source: amazon-inspector 50769b8e4194fae74ccb6edfe5d0faff22c235bb3c9a9173e5f5073eecd3517b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in commercial-jade-alpaca (npm)
Source: amazon-inspector d217ccb3ca894ed0ffb8bb683d7e32bac26b6508da66809dd7f49c4e12cb8da5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in clumsy-coffee-alpaca (npm)
Source: amazon-inspector f9df5d6d5e609419ad2130c5f0282007728a215b3ec9a541959387acf00c4004 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in closed-lavender-alpaca (npm)
Source: amazon-inspector 288dcdf8a148dcdee2cb43707511bbdcb896bbd1c777066e13c2a22c2703646a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
Malicious code in awkward-olive-alpaca (npm)
Source: amazon-inspector 01e8dcce2390235a89528e3abdf84a3fd3cd54b1f7b2b010b53a7a060c0c12b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
alpaca-farm (>=0.1.10, <=0.2.0) potentially affected by CVE-2026-69112 via accelerate (0.20.0)
accelerate PYPI version 0.20.0 is affected by a known vulnerability. The following packages have a transitive dependency on accelerate and may be impacted: - alpaca-farm =0.1.10, =0.2.0 Source cves: CVE-2026-69112 Source advisory: OSV:GHSA-4J2P-28Q2-5M79...
ag-llama-api (>=0.0.8, <=0.0.31), ag-llama-api-s (>=0.0.4, <=0.0.11) +27 more potentially affected by CVE-2026-9856 via transformers (4.29.2)
transformers PYPI version 4.29.2 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ag-llama-api =0.0.8, =0.0.4, =0.0.4, =0.0.11, =0.0.3, =0.1.10, =0.2.0, =0.1.0, =0.0.1, =0.5.1.dev20240517, =0.5.2 and more Source cves:...
ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0), ca.islandora.alpaca:islandora-connector-derivative (>=2.0.0, <=2.2.0) +28 more potentially affected by CVE-2026-40860 via org.apache.camel:camel-activemq (>=3.0.0, <=4.14.6)
org.apache.camel:camel-activemq MAVEN version =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =0.46, =0.3, =0.5, =0.1, =0.1, =6.0.0, =1.6.0, =0.1.0, =0.11.5 and more Source cves: CVE-2026-40860 Source advisory: GHSA-M5VH-3FW5-5WGH...
ca.islandora.alpaca:islandora-alpaca-app (>=2.0.0, <=2.2.0), ca.islandora.alpaca:islandora-connector-derivative (>=2.0.0, <=2.2.0) +81 more potentially affected by CVE-2026-40860 via org.apache.camel:camel-jms (>=3.0.0, <=4.14.6)
org.apache.camel:camel-jms MAVEN version =3.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =3.0.0, =0.46, =0.3, =0.5, =0.1, =0.1, =1.0, =hyte-mq-4.3.7.hyte-43072, =hyte-mq-4.3.7.hyte-43072, =4.4.11.hyte-26354 and more Source cves: CVE-2026-40860 Source advisory: OSV:GHSA-M5VH-3FW5-5WGH...
BIT-NGINX-GATEWAY-2021-3618
ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic fr...
EUVD-2025-117161
Malicious code in private-violet-alpaca npm...
EUVD-2025-103395
Malicious code in obedientalpacaz3n npm...