RLSA-2025:14126 Important: pki-deps:10.6 security update

The Public Key Infrastructure PKI Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System. Security Fixes: com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError CVE-2025-52999 For more details about the security issues,...

RockyLinux 8 : pki-deps:10.6 (RLSA-2025:14126)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:14126 advisory. com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError CVE-2025-52999 Tenable has extracted the preceding description block directly...

Malicious code in dependencies-backend-mutation-string (npm)

The package dependencies-backend-mutation-string was found to contain malicious code...

Malicious code in restart-dependencies-antares-cluster (npm)

The package restart-dependencies-antares-cluster was found to contain malicious code...

Malicious code in version-dependencies-link-cressida (npm)

The package version-dependencies-link-cressida was found to contain malicious code...

Malicious code in tardigrade-relay-ganymede-dependencies (npm)

The package tardigrade-relay-ganymede-dependencies was found to contain malicious code...

Malicious code in enceladus-altair-dependencies-eventhoriz (npm)

The package enceladus-altair-dependencies-eventhoriz was found to contain malicious code...

MAL-2025-46510 Malicious code in version-dependencies-link-cressida (npm)

The package version-dependencies-link-cressida was found to contain malicious code...

MAL-2025-46240 Malicious code in tardigrade-relay-ganymede-dependencies (npm)

The package tardigrade-relay-ganymede-dependencies was found to contain malicious code...

MAL-2025-43963 Malicious code in dependencies-backend-mutation-string (npm)

The package dependencies-backend-mutation-string was found to contain malicious code...

MAL-2025-45824 Malicious code in restart-dependencies-antares-cluster (npm)

The package restart-dependencies-antares-cluster was found to contain malicious code...

MAL-2025-44138 Malicious code in enceladus-altair-dependencies-eventhoriz (npm)

The package enceladus-altair-dependencies-eventhoriz was found to contain malicious code...

Fedora 44 : glycin / rust-ashpd / rust-ashpd0.11 / rust-glycin / etc (2025-bb172624a9)

The remote Fedora 44 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2025-bb172624a9 advisory. Update glycin to version 2.0.rc. This update also includes a bunch of related Rust dependency updates for GNOME 49.rc. Additionally, CVE-2025-58160 is...

Linux Distros Unpatched Vulnerability : CVE-2025-27607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Python JSON Logger is a JSON Formatter for Python Logging. Between 30 December 2024 and 4 March 2025 Python JSON Logger was vulnerable to RCE through a missing...

Linux Distros Unpatched Vulnerability : CVE-2021-44568

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via the resolvedependencies function at...

An Empirical Study of Vulnerable Package Dependencies in LLM Repositories

Large language models LLMs have developed rapidly in recent years, revolutionizing various fields. Despite their widespread success, LLMs heavily rely on external code dependencies from package management systems, creating a complex and interconnected LLM dependency supply chain. Vulnerabilities ...

Fedora 29 : edk2 (2019-bff1cbaba3)

The remote Fedora 29 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2019-bff1cbaba3 advisory. Use YYYYMMDD versioning to fix upgrade path ---- Update to stable-201903 Update to openssl-1.1.0j Move to python3 deps Tenable has extracted the...

Linux Distros Unpatched Vulnerability : CVE-2021-22259

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A potential DOS vulnerability was discovered in GitLab EE starting with version 12.6 due to lack of pagination in dependencies API. CVE-2021-22259 Note that...

Linux Distros Unpatched Vulnerability : CVE-2021-41116

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are...

RUSTSEC-2025-0157 `statsrelay-protobuf` was removed from crates.io for malicious code

statsrelay-protobuf was part of a campaign that attempted to exfiltrate environmental data from the host. The malicious crate had 1 version published in August 2025, and had no evidence of actual usage. This crate had no dependencies on crates.io...