SUSE SLES16 Security Update : expat (SUSE-SU-2026:23912-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23912-1 advisory. - CVE-2026-41080: crafted XML document can cause a denial of service bsc1262263. - CVE-2026-45186: In libexpat before 2.8.1, the...

AlmaLinux 9.6 [TuxCare] Security Update: gstreamer1 / gstreamer1-devel (ALMALINUX9.6:CLSA-2026:1776433691)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1776433691 advisory. - GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the function...

CVE-2026-51871

Devika v1.0 is vulnerable to Code Injection within the Runner.execute function located in src/agents/runner/runner.py. The root cause is the direct execution of content generated by a Large Language Model (LLM) , which allows an attacker to achieve arbitrary code execution . As a temporary workar...

TencentOS Server 3: pcp (TSSA-2026:1084)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:1084 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

SUSE CVE-2026-19547

Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searching for PostScript resource files in predictable paths under C:\gs\ that do not exist by default on Windows installations, combined with Windows default...

SUSE CVE-2026-102566

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or...

Malicious code in common-fs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3d99fa69df24bb5170c840f84e44038c20cf8b431c94abfd57eaa3701593684 common-fs advertises itself as a filesystem/transaction helper but ships an obfuscated code loader. index.js reconstructs the identifiers 'Function',...

MAL-2026-17300 Malicious code in common-fs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3d99fa69df24bb5170c840f84e44038c20cf8b431c94abfd57eaa3701593684 common-fs advertises itself as a filesystem/transaction helper but ships an obfuscated code loader. index.js reconstructs the identifiers 'Function',...

CVE-2026-103041

LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interfaces. Attackers can send crafted serialized objects to exposed cache methods to execute arbitrary code with service privileges...

Malicious code in test-agency-assign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e650e815b4409c3c07cdab7c953ed69b8052f32a28c3686397ab362bb1bd4552 [email protected] declares a package.json postinstall script wscript.exe Kelimasow.exe that auto-executes a bundled 8.4 MB Go-compiled Windows...

MAL-2026-17295 Malicious code in test-agency-assign (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e650e815b4409c3c07cdab7c953ed69b8052f32a28c3686397ab362bb1bd4552 [email protected] declares a package.json postinstall script wscript.exe Kelimasow.exe that auto-executes a bundled 8.4 MB Go-compiled Windows...

CVE-2026-103040 LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Router Profiler RPyC Service

LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enableprofiling flag. The service exposes an unauthenticated RPyC server with pickle deserialization enabled, allowing attackers to execute arbitrary code by sending crafted...

CVE-2026-91191

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed...

CVE-2026-84409

The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A management interface subsequently returns this stored value in a JSON response, and the web interface responsible for displaying update...

Malicious code in @rutxploit-sec/subsplash-canny (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1ebadea2eb63a0fc7cf7446e36a589c5b87fc7d28e68b68145b98577107ebb npm package @rutxploit-sec/subsplash-canny declares a preinstall lifecycle script that runs node -e inline code reading os.hostname and...

CVE-2026-102930

A flaw was found in virtualenv. When fetching seed packages such as pip or setuptools during environment creation or updates, virtualenv does not verify the integrity of downloaded files against authoritative cryptographic checksums. A network attacker or compromised mirror could substitute...

CVE-2026-102925

A flaw was found in virtualenv. The generated activation scripts for shells such as bash, zsh, and fish apply improper quoting to environment and library path variables. An attacker can exploit this by providing a crafted virtual environment path containing shell metacharacters. When an...

MAL-2026-17285 Malicious code in @akapaki/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c14fdf44df68d2544cc235039ef40a99c7df7bcbfc968e8d5809762031f0dd16 @akapaki/[email protected] is an unofficial republish of the Baileys WhatsApp library under a new scope author paki, empty README, repository...

CVE-2026-91191 Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed...

CVE-2026-91191

The Lantronix G520 Series Cellular Gateway is vulnerable to an improper verification of cryptographic signatures in its update mechanism. During boot, the stock done function disables signature verification in the OPKG configuration before restoring packages from an unsigned feed. Furthermore, th...