Malicious code in pino-ulid (npm)

The npm package pino-ulid is named like a ULID generator, but it is a remote-access trojan. On install, its package.json postinstall script runs node dist/node/utils.js after checking the dist files exist with existsSync. dist/node/utils.js writes a PID lock file, sets up persistence on Windows...

Oracle Linux 8 : ELSA-2026-67161-0: / git-lfs (ELSA-2026-671610)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2026-671610 advisory. 3.4.1-13 - Rebuild with new Golang - Resolves: RHEL-241521, RHEL-242322, RHEL-241889 Tenable has extracted the preceding description block directly...

MiracleLinux 8 : ansible-core-2.16.3-4.el8_10.ML.1 (AXSA:2026-1818:04)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1818:04 advisory. ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution CVE-2026-11332 Tenable has extracted the preceding...

AlmaLinux 8 : osbuild-composer (ALSA-2026:67148)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:67148 advisory. crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec CVE-2025-22866 crypto/x509: golang: Go crypto/x509:...

AlmaLinux 8 : git-lfs (ALSA-2026:67161)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:67161 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...

Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-2143)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2143 advisory. In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: ADDADDR rtx: always decrease sk refcount CVE-2026-46158 In the Linux kernel, the following vulnerability has been...

AlmaLinux 8 : ruby:3.3 (ALSA-2026:50728)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:50728 advisory. zlib: zlib: Memory corruption via buffer overflow in Zlib::GzipReader CVE-2026-27820 net-imap: Net::IMAP: Arbitrary IMAP command injection via CRLF...

RHEL 9 : delve (RHSA-2026:67128)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67128 advisory. Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go...

Linux Distros Unpatched Vulnerability : CVE-2026-89673

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: fix XDR padding calculation in ffencodegetdeviceinfo nfsd4ffencodegetdeviceinfo computes the daaddrbody reservation as 16 + netidlen + addrlen, but the...

Linux Distros Unpatched Vulnerability : CVE-2026-90947

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light...

CVE-2026-15396: Inconsistent Interpretation of HTTP Requests

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty are vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header. By sending a specially crafted HTTP transfer-encoding request header, an attacker could...

Linux Distros Unpatched Vulnerability : CVE-2025-24890

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user a...

VulnCheck KEV: CVE-2026-55786

Unauthenticated Command Execution via HTTP MCP executemodule Summary The HTTP MCP endpoint POST /mcp in flyto-core accepts unauthenticated JSON-RPC tools/call requests and dispatches them to arbitrary registered modules, including sandbox.executeshell, which passes attacker-controlled input...

RHEL 9 : openssl (RHSA-2026:67165)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67165 advisory. OpenSSL is a toolkit that implements the Secure Sockets Layer SSL and Transport Layer Security TLS protocols, as well as a full-strength...

Amazon Linux 2 : openssl (ALAS-2026-3919)

The version of openssl installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3919 advisory. Issue summary: Receiving a DTLS record for a future epoch while a handshakeis in progress causes OpenSSL to buffer far...

RHEL 9 : rust (RHSA-2026:67285)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:67285 advisory. Rust is a systems programming language that runs blazingly fast, prevents segfaults, and guarantees thread safety. This package includes the Rust...

Amazon Linux 2023 : expat, expat-devel, expat-static (ALAS2023-2026-2157)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2157 advisory. libexpat before 2.8.2 lacks handler call depth tracking for calls to XMLGetBuffer, XMLParse, XMLParseBuffer, XMLParserFree, or XMLParserReset from within handlers in cases of a policy violatio...

Amazon Linux 2 : edk2 (ALAS-2026-3908)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3908 advisory. Issue summary: Receiving a DTLS record for a future epoch while a handshakeis in progress causes OpenSSL to buffer far more memory than the recorditself requires. Impact summary: A peer can use a...

RHEL 9 : rsync (RHSA-2026:67462)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67462 advisory. The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because...

RHEL 9 : git-lfs (RHSA-2026:67287)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67287 advisory. Git Large File Storage LFS replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while...