PT-2026-74286

TuxCare rebuilt pdfjs-dist to address 1 CVE. Fixed in 3.11.174-tuxcare.1...

MAL-2026-11133 Malicious code in chain-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...

Malicious code in chain-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb22a3b9c64598bc202456844105c3e3e7f7e7185abe335b2694d85deb1b6c9d The published tarball's dist bundles dist/sigchain-js.cjs.js, dist/sigchain-js.esm.js, dist/sigchain-js.umd.js execute at module load: they read an...

Joomla! Configuration File - Detect

Joomla! configuration.php-dist file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Joomla! configuration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Joomla! Configuration File - Detect', 'description...

Malicious code in relativity-pdfjs-dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 542f0656a76929fa6bd11c9d8ff36f9f69c5865f46d835b8c707a803d71aa55f package.json declares a preinstall script that runs node -e inline JavaScript on npm install. The inline code collects the installer's hostname,...

MAL-2026-10778 Malicious code in relativity-pdfjs-dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 542f0656a76929fa6bd11c9d8ff36f9f69c5865f46d835b8c707a803d71aa55f package.json declares a preinstall script that runs node -e inline JavaScript on npm install. The inline code collects the installer's hostname,...

CVE-2026-48819: Improperly Controlled Modification of Object Prototype Attributes

Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body, $headers, $path, and $query...

Malicious code in ai-pro-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b035f137addcf0118c3d042ece322d0fdde054e4ed283317d3b2adb309e38689 [email protected] is advertised as a Vercel AI SDK provider for Claude via the Claude Agent SDK, but the published tarball ships no code: package.json...

MAL-2026-10629 Malicious code in ai-pro-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b035f137addcf0118c3d042ece322d0fdde054e4ed283317d3b2adb309e38689 [email protected] is advertised as a Vercel AI SDK provider for Claude via the Claude Agent SDK, but the published tarball ships no code: package.json...

pyp2spec is Vulnerable to Code Injection

Impactpyp2spec was writing PyPI package metadata e.g. the summary field into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, so a malicious package can execute arbitrary commands on the build machine.The macro...

CVE-2026-15033

A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils.js of the component peerDependencies. This manipulation causes os command injection. The attack may be initiated remotely. The...

CVE-2026-15033: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in christopherthielen check-peer-dependencies up to 4.3.4. Affected by this vulnerability is the function shelljs.exec of the file dist/packageUtils.js of the component peerDependencies. This manipulation causes os command injection. The attack may be initiated remotely. The...

kinto-dist (>=0.7.0, <=0.8.2) potentially affected by CVE-2024-1314 via kinto-attachment (0.8.0)

kinto-attachment PYPI version 0.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist =0.7.0, =0.8.2 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

kinto-dist (>=17.4.0, <=18.0.2) potentially affected by CVE-2024-1314 via kinto-attachment (>=6.0.1, <=6.0.2)

kinto-attachment PYPI version =6.0.1, =17.4.0, =18.0.2 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

kinto-dist (>=1.0.0, <=1.11.0) potentially affected by CVE-2024-1314 via kinto-attachment (1.0.1)

kinto-attachment PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist =1.0.0, =1.11.0 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

kinto-dist (>=1.12.0, <=1.13.0) potentially affected by CVE-2024-1314 via kinto-attachment (1.1.2)

kinto-attachment PYPI version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist =1.12.0, =1.13.0 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

kinto-dist (4.5.2) potentially affected by CVE-2024-1314 via kinto-attachment (2.0.1)

kinto-attachment PYPI version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on kinto-attachment and may be impacted: - kinto-dist 4.5.2 Source cves: CVE-2024-1314 Source advisory: OSV:PYSEC-2026-1494...

[SECURITY] Fedora 43 Update: sandogasa-0.15.3-2.fc43

A collection of tools and libraries for Fedora package maintenance and contributor activity tracking, built around shared API clients for Bugzilla, Bodhi, NVD, dist-git, Discourse, FASJSON, and HyperKitty. The name sandogasa =E8=8F=85=E7=AC=A0 refers to a Japanese straw hat of ten associated with...

[SECURITY] Fedora 44 Update: sandogasa-0.15.3-2.fc44

A collection of tools and libraries for Fedora package maintenance and contributor activity tracking, built around shared API clients for Bugzilla, Bodhi, NVD, dist-git, Discourse, FASJSON, and HyperKitty. The name sandogasa =E8=8F=85=E7=AC=A0 refers to a Japanese straw hat of ten associated with...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.2.9, <=1.3.0), com.github.vzakharchenko:cisco-radius-plugin (>=1.2.9, <=1.3.0) +21 more potentially affected by CVE-2026-9795 via org.keycloak:keycloak-services (12.0.0)

org.keycloak:keycloak-services MAVEN version 12.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9,...