java-17-openjdk security update

1:17.0.20.0.8-1.1.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:17.0.20.0.8-1.1 - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8 - Add .0 to prelease 1:17.0.20.0.8-1.1 - Sync NEWS from private-gnuandrew-rhel-8.5-vanilla 1:17.0.20.0.8-1.1 - Set tzdata requires and build...

MAL-2026-12115 Malicious code in streak-math-calc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f98537ccfd6214a3970375d9c210e83853153b35b19193b4b1850fe6450ed4f The package's main entry dist/index.mjs runs a top-level IIFE that chmod +x's a bundled ELF at dist/math-calc.bin and spawns it detached with piped...

Malicious code in streak-math-calc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f98537ccfd6214a3970375d9c210e83853153b35b19193b4b1850fe6450ed4f The package's main entry dist/index.mjs runs a top-level IIFE that chmod +x's a bundled ELF at dist/math-calc.bin and spawns it detached with piped...

resource-agents security update

4.9.0-54.36 - bundled urllib3: fix CVE-2026-44431 Resolves: RHEL-178598...

SUSE CVE-2026-58586

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 released 2013-03-20. That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decod...

CVE-2026-58586

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 released 2013-03-20. That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decod...

CVE-2026-58586

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 released 2013-03-20. That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decod...

CVE-2026-58586

CVE-2026-58586 concerns Image::WebP (Perl) versions through 0.2 that bundle libwebp 0.3.0. The module links the vulnerable library inside itself instead of using the system libwebp, so upgrading system libraries does not remediate. The bundled libwebp 0.3.0 contains multiple known issues, includi...

EUVD-2026-48614

Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 released 2013-03-20. That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decode...

CVE-2026-58586 Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 released 2013-03-20. That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decod...

CVE-2026-58586 Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp

Image::WebP versions before 0.3.0 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 released 2013-03-20. That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decod...

PT-2026-64315

Name of the Vulnerable Software and Affected Versions Image::WebP versions prior to 0.3.0 Description Image::WebP bundles a copy of libwebp version 0.3.0 instead of linking to the system library. This bundled version contains multiple known security flaws. The issue occurs when the module decodes...

Security update for beets (moderate)

openSUSE security update: security update for beets ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21383-1 Rating: moderate References: bsc1263988 Cross-References: CVE-2026-42052 Affected Products: openSUSE Leap 16.0...

MAL-2026-10721 Malicious code in @whalent/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13a01c1162adb93d3960d9e1b1b67095dcf0a1ea72aefa6d471d0abbbabb5d9a The package installs a whalent CLI daemon that opens a persistent WebSocket connection wss:// to a Whalent Memory gateway and, per its own README,...

CVE-2026-14906

Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bundled content within the Firefox for iOS application sandbox. This vulnerability was fixed in Firefox for iOS 152.4...

Fedora 44 : opkssh (2026-a7570524a7)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-a7570524a7 advisory. Update to opkssh 0.15.0. This release fixes several CVEs in bundled/vendored dependencies: - CVE-2026-39829: golang.org/x/crypto/ssh: Denial of...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: ruby3.4: ruby3.4-3.4.9-31.4.hum1 aarch64, x8664 ruby3.4-bundled-gems-3.4.9-31.4.hum1 aarch64, x8664 ruby3.4-default-gems-3.4.9-31.4.hum1 noarch ruby3.4-devel-3.4.9-31.4.hum1 aarch64, x8664...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: ruby4.0: ruby4.0-4.0.0-33.4.hum1 aarch64, x8664 ruby4.0-bundled-gems-4.0.0-33.4.hum1 aarch64, x8664 ruby4.0-default-gems-4.0.0-33.4.hum1 noarch ruby4.0-devel-4.0.0-33.4.hum1 aarch64, x8664...

CVE-2026-9710

The CVE covers the premium Cornerstone WordPress component bundled with X Theme, affected versions before 7.8.8. Root cause: a CSS-preview request handler did not enforce capability checks and exposed the nonce to every logged-in user on wp-admin pages. Impact: any authenticated user can evaluate...

Malicious code in mastraqqq (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ab6891e53f407a1aebddb94c7d02dab202313f4576e37f378dfc2fc50705cd4 Package is published as mastraqqq but bundles a verbatim clone of the legitimate mastra CLI: the embedded package metadata declares name: "mastra",...