Clam AntiVirus Toolkit 1.5.4

Clam AntiVirus is an anti-virus toolkit for Unix. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command-line scanner, and a tool for automatic updating via Internet. The programs ar...

SUSE CVE-2026-68742

A flaw was found in SSSD. The sssnssprotocolparseaddr function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and...

SUSE CVE-2026-68744

A flaw was found in SSSD. The sssnssprotocolfillinitgr function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to...

Malicious code in remote-claude-daemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9c092b787277e3c89fc27a6c01e5360bc0566988cefca0b1a0f9626af9186d0 remote-claude-daemon connects to a hardcoded WebSocket relay at wss://remote-claude-relay.fly.dev and treats inbound messages as commands executed...

MAL-2026-13455 Malicious code in remote-claude-daemon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9c092b787277e3c89fc27a6c01e5360bc0566988cefca0b1a0f9626af9186d0 remote-claude-daemon connects to a hardcoded WebSocket relay at wss://remote-claude-relay.fly.dev and treats inbound messages as commands executed...

Malicious code in gpt-terminal-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cefb2fc03ba2c4d843d8f15257be48318cde8e611cc3c80002f735af489a0f0a Package advertises itself as an AI chat CLI but its scripts.postinstall runs src/postinstall.js, which spawns src/implant/loader.js as a detached...

Important: Red Hat Security Advisory: yggdrasil security update

An update for yggdrasil is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

[SECURITY] [DSA 6414-1] udisks2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6414-1 [email protected] https://www.debian.org/security/ Alberto Garcia August 06, 2026 https://www.debian.org/security/faq -...

gpsd: gpsd: Command Injection via GPS device subtype allows arbitrary code execution

A flaw was found in gpsd, a service application that monitors one or more GPSes or AIS receivers. The gpsprof utility is vulnerable to a command injection. An attacker who can control the GPS device subtype value can embed malicious commands within the gnuplot plot title. When a user processes a...

Malicious code in @addai/node (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ca685518d56ea513609a2dfcd845bb14d94c3faaf58645553c688ca59817921 The package installs a background daemon dist/session-runner.js that pairs the host to a remote +Ai account and polls a hardcoded Supabase backend at...

Malicious code in @vanexalabs-ai/vanexa-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5de2359eef117d1f491dc2c8628e56d866435912bd6f8e55a10eee8e7a9a6c The package implements a daemon that pairs with a remote peer phone over WebRTC, using https://vanexa-agent-relay.workers.dev and...

MAL-2026-13397 Malicious code in @vanexalabs-ai/vanexa-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab5de2359eef117d1f491dc2c8628e56d866435912bd6f8e55a10eee8e7a9a6c The package implements a daemon that pairs with a remote peer phone over WebRTC, using https://vanexa-agent-relay.workers.dev and...

ALSA-2026:51075 Important: gpsd security update

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. With gpsd, multiple GPS client applications such as...

MiracleLinux 9 : perl-HTTP-Daemon-6.12-6.el9_8.1 (AXSA:2026-1466:02)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1466:02 advisory. perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in sendfile CVE-2026-8450 Tenable has extracted the preceding description...

EulerOS 2.0 SP13 : nfs-utils (EulerOS-SA-2026-2983)

According to the versions of the nfs-utils packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was recently discovered in the rpc.mountd daemon in the nfs-utils package for Linux, that allows a NFSv3 client to escalate the...

EulerOS 2.0 SP15 : rsync (EulerOS-SA-2026-2907)

According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement wh...

EulerOS 2.0 SP15 : sssd (EulerOS-SA-2026-2952)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the System Security Services Daemon SSSD. The pampasskeychildreaddata function within the PAM passkey responder fails to properl...

EulerOS 2.0 SP15 : sssd (EulerOS-SA-2026-2911)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the System Security Services Daemon SSSD. The pampasskeychildreaddata function within the PAM passkey responder fails to properl...

Important: gpsd-minimal security update

gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer. The AlmaLinux support for this package is limited...

Malicious code in @agenthub-ai/agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 759e28e403a082017b33bb95bcc8c1d7abd229a59375b8a4a3de9841c89d3379 Package installs a long-running daemon that opens a persistent WebSocket to wss://agenthub-agent.fyenet.com and dispatches command envelopes from the...