MAL-2026-12687 Malicious code in delivery-ci-upgrade-from (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46b1b760480eca3b3ad596491193f7aa55ed0a3e982d6978c071e04e793ff8b0 index.js unconditionally requires bridge.js, which runs a bootstrap routine on module load. The bootstrap selects a platform-specific path linuxx64,...

MAL-2026-12719 Malicious code in devplatform-jscodeshift-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b08e96920cfa51b02e6ac450e73eb86615b96651f96cd8c94f0f272880689b9 The package presents itself as a jscodeshift helper library exporting deepMerge/sleep/retry/chunk utilities, but index.js unconditionally invokes try...

MAL-2026-12248 Malicious code in tinkoff-pfp-block-mobile-advert-footer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 12bd549b3c3a286caedd91cb1bbc6052850f23c01f5eaa33e7c336db1928258c On require of index.js, the package silently loads bootstrap.js, which reconstructs attacker-controlled hostnames from split-string fragments...

SUSE SLES16: go1.24 / go1.24-doc / go1.24-openssl / go1.24-openssl-doc / etc (SUSE-SU-2026:22950-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22950-1 advisory. Changes in go compilers: - Switch from update-alternatives to new method. - Packaging improvements: Revert %ghost /usr/bin/go /usr/bin/gofm...

Root-My-Device-Payloads

Root My Device Payloads A fork of BuSung-dev/Root-My-Galaxy-...

SUSE-SU-2026:22950-1 Security update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21

This update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21 fixes the following issues: Changes in go compilers: - Switch from update-alternatives to new method. - Packaging improvements: Revert %ghost /usr/bin/go...

SUSE-SU-2026:22958-1 Security update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21

This update for go1.26-openssl, go1.25-openssl, go1.24-openssl, go1.23-openssl, go1.22-openssl, go1.26, go1.25, go1.24, go1.23, go1.22, go1.21 fixes the following issues: Changes in go compilers: - Switch from update-alternatives to new method. - Packaging improvements: Revert %ghost /usr/bin/go...

Root-My-Galaxy-Payloads

Root My Galaxy Payloads This repository contains the device-s...

ROOT-APP-NPM-CVE-2025-1647 CVE-2025-1647 in @rootio/bootstrap - Patched by Root

Root has patched CVE-2025-1647 in the @rootio/bootstrap package for Root:npm. Multiple fixed versions available...

python3.14-pip security update

25.2-5 - Fix gating plan - removed unnecessary older VERSION= tests - removed bootstrap test - fix pipinstallupgrade to run pip-3.14 - fix bash completion + remove unused metadata file 25.2-4 - Security fix for CVE-2026-8643: path traversal in wheel entry points...

GHSA-F8H2-VMM9-QHJ6 vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

CVE-2026-45591 vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

GHSA-7Q4V-2MR6-5GPX vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

CVE-2026-45491 vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

GHSA-F8H2-VMM9-QHJ6 vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

GHSA-7Q4V-2MR6-5GPX vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

CVE-2026-45591 vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

CVE-2026-45491 vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

CVE-2026-36214

CVE-2026-36214 — osTicket Stored XSS affects osTicket versions 1.10–1.17.7 and 1.18.0–1.18.3 due to a vulnerable Bootstrap Tooltip (3.3.4) and insufficient HTML sanitization. The attack stores a malicious JS payload in a ticket attachment and executes it when an Agent/Admin views the ticket, enab...

CVE-2026-36214

osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip component and insufficient HTML sanitization, allowing remote attackers to execute arbitrary JavaScript in Agent or Admin sessions...