OESA-2026-2908 cockpit security update

Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package. Security Fixes: A flaw was found in Cockpit. Deleting a sosreport with a crafte...

CVE-2026-47829

Argument Injection in bosh-cli allows a compromised BOSH Director to inject arbitrary OpenSSH options into the locally-spawned ssh process when an operator runs bosh ssh -c, bosh logs -f, or other non-interactive SSH paths, leading to local command execution on the operator's workstation. Affecte...

Malicious code in clavuepro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97a9e3cf794eb2bc8d9ebb4bab007a52bf9fc1ed9dbc3db19695542503ec253e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-7029 Malicious code in clavue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ffc14d0e15af336ff2709e543272d2386d767fe185b380c5f2c2baeb78c3cbf The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-7030 Malicious code in clavue-agent-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 399c0d2f1fabfa46b35810b70797862a0fd469076fa9496549237ab413ccada2 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-7032 Malicious code in myclaude-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3597c40ce7f730173367aa9f9cc4f29c53af17524c19c4814caafa08cd1b20bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in calvuepro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9de2057a076c31ca107db2c3e8d330a7b4aa2d8d67896cecd6c7ebef21d07731 Package ships a 5.7MB prebuilt darwin-arm64 Mach-O at vendor/clavuepro-darwin-arm64 with no source tree, no hash/signature verification, and no...

Malicious code in clavue-agent-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 399c0d2f1fabfa46b35810b70797862a0fd469076fa9496549237ab413ccada2 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in clavue (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ffc14d0e15af336ff2709e543272d2386d767fe185b380c5f2c2baeb78c3cbf The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

EUVD-2026-42505

A compromised or malicious BOSH Director can execute arbitrary shell commands on the operator's workstation when the operator runs bosh ssh or bosh scp/bosh logs -f with default flags. Affected versions: BOSH CLI versions prior to 7.10.5...

EUVD-2026-42449

Use after free in Core in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

PT-2026-56921

Name of the Vulnerable Software and Affected Versions OpenPLC Runtime version 3 Description An authenticated arbitrary file write exists in the legacy web UI program-upload workflow. The application stores an attacker-supplied filename prog file into the Programs.File database field and uses this...

The vulnerability of the LibreOffice office software package, related to overflowing dynamic memory buffers, allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the LibreOffice office software package is related to overflowing buffers in dynamic memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information through a specially created document...

CVE-2026-15119

Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

DEBIAN-CVE-2026-15119

Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

MAL-2026-7018 Malicious code in n8n-nodes-barcode-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb55ae2b864b933ae071cb33e8f53a52005ff0dc26487d15639f3b07fa7d9849 The package presents itself as an n8n community node for barcode generation, but dist/credentials/BarcodeGeneratorApi.credentials.js contains a...

jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the...

MAL-2026-7008 Malicious code in chai-as-const (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2c70991a87f00f1b25b85243d1984fcb2562dc2c34f0c5514827b3660350294 [email protected] is a disguised dropper. The package name is unrelated to its code, which impersonates the pino logger exports pino middleware,...

MAL-2026-6995 Malicious code in chai-redirection (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38236fbbdbbaa8f8ed9315c3a4ff01fbf049215896036b1cb68611681fe0eb00 chai-redirection presents itself as a chai assertion plugin but its main entry index.js unconditionally spawns a detached Node child process running...

MAL-2026-6991 Malicious code in airkey-mfa-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector addd30fd6d90110d178ea017b2968c6014dab0e8304bdfeb55b13612a75f61da Package auto-executes a preinstall script node test.js on npm install that collects username, hostname, platform, Node version, and CI flag and POSTs...