GHSA-Q4XH-88C3-WMH7 vulnerabilities

Vulnerabilities for packages: nextflow, tinkerpop, kafbat-ui-fips, akhq, apache-pulsar-fips, celeborn, wso2is, logstash, apache-activemq, apache-pulsar, ruby3.4-jrjackson, cruise-control, drain-cleaner, nuxeo, spark-fips, flink-kubernetes-operator, keycloak-config-cli,...

GHSA-GX83-3VF8-GH7J vulnerabilities

Vulnerabilities for packages: nextflow, tinkerpop, kafbat-ui-fips, akhq, apache-pulsar-fips, celeborn, wso2is, logstash, apache-activemq, apache-pulsar, ruby3.4-jrjackson, cruise-control, drain-cleaner, nuxeo, spark-fips, flink-kubernetes-operator, keycloak-config-cli,...

CVE-2026-19032 vulnerabilities

Vulnerabilities for packages: nextflow, tinkerpop, kafbat-ui-fips, akhq, apache-pulsar-fips, celeborn, wso2is, logstash, apache-activemq, apache-pulsar, ruby3.4-jrjackson, cruise-control, drain-cleaner, nuxeo, spark-fips, flink-kubernetes-operator, keycloak-config-cli,...

GHSA-WJGM-6HV5-3CVF vulnerabilities

Vulnerabilities for packages: nextflow, tinkerpop, kafbat-ui-fips, akhq, apache-pulsar-fips, celeborn, wso2is, logstash, apache-activemq, apache-pulsar, ruby3.4-jrjackson, cruise-control, drain-cleaner, nuxeo, spark-fips, flink-kubernetes-operator, keycloak-config-cli,...

GO-2026-6508 vulnerabilities

Vulnerabilities for packages: loki, elastic-agent, aws-otel-collector-fips, opentofu-fips, distribution-fips, amazon-cloudwatch-agent-fips, tempo, caddy-fips, loki-fips, grafana-geomys-fips, terraform, frankenphp-8.4, datadog-agent, amazon-cloudwatch-agent, grafana-mimir, kots, commercial-grafana...

GO-2026-6508 vulnerabilities

Vulnerabilities for packages: kots, caddy, tempo, grafana, pulumi-kubernetes-operator, harbor-registry, grafana-alloy, aws-otel-collector, opentofu, grafana-mimir, distribution, datadog-agent, falcosidekick, fluent-bit-plugin-loki, zot, loki, grafana-pyroscope, mcp-grafana, amazon-cloudwatch-agen...

CVE-2026-49265

A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The "codechallengemethodplain" function uses Python's standard "==" operator for string comparison instead of a constant-time comparison function, potentially allowing timing-based...

Security Bulletin: IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to CVE-2026-18513, CVE-2026-18537, CVE-2026-18529, CVE-2026-18533, CVE-2026-18517 and CVE-2026-88029

Summary IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to CVE-2026-18513, CVE-2026-18537, CVE-2026-18529, CVE-2026-18533, CVE-2026-18517 and CVE-2026-88029 because of CR author can redirect arcgis-admin RoleBinding to own ServiceAccount, CR author can override...

MyModel

xss-specialist A Kev-style XSS decision model + an ex...

Malicious code in @hrmony/kit-4 (npm)

Source: amazon-inspector cb6ac778d35433101385eb57755b6079e76c7bb3dc40306218cf5b1295d5a853 The package runs credential-harvesting code both at install time and at import time. The declared preinstall hook scripts/check-setup.mjs queries the AWS EC2 instance metadata service IMDSv2 at 169.254.169.2...

GHSA-XPV3-W29H-X7CV Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Summary A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The codechallengemethodplain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing...

Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)

Summary A timing side-channel vulnerability exists in the PKCE RFC 7636 implementation of the Authorization Code Grant flow. The codechallengemethodplain function uses Python's standard == operator for string comparison instead of a constant-time comparison function, potentially allowing...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the codechallengemethods256 and codechallengemethodplain functions in oauthlib/oauth2/rfc6749/granttypes/authorizationcode.py, which compare PKCE code verifiers and challenges using the non-constant-time == operator. A...

MAL-2026-17265 Malicious code in @hrmony/kit-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6ac778d35433101385eb57755b6079e76c7bb3dc40306218cf5b1295d5a853 The package runs credential-harvesting code both at install time and at import time. The declared preinstall hook scripts/check-setup.mjs queries the...

Malicious code in @hrmony/kit-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb6ac778d35433101385eb57755b6079e76c7bb3dc40306218cf5b1295d5a853 The package runs credential-harvesting code both at install time and at import time. The declared preinstall hook scripts/check-setup.mjs queries the...

Important: Red Hat Security Advisory: Ansible automation portal (Technology Preview)

Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for the Red Hat Ansible Automation Portal Operator. Red Hat Ansible Automation Platform 2.2 delivers the Automation Portal Operator for managing Ansible Automation...

Malicious code in exptred (npm)

Source: amazon-inspector d91842ab3e5c93f5689a985b63f8de5455910d88d6815ee35f2d35d27f8a4cf7 npm package [email protected] is a typosquat of express: package.json copies express's description 'Fast, unopinionated, minimalist web framework', author TJ Holowaychuk, repository expressjs/express, and homepa...

Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition

Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate Developer Edition version 2.17.0 Vulnerability Details CVEID:CVE-2026-42923 DESCRIPTION: NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the...

CVE-2026-102507

Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3...

Security update for jsoup, re2j

This update for jsoup, re2j fixes the following issue: CVE-2026-75140: The builder copies the entire inherited namespace map on every start element, causing quadratic time and memory complexity, which attackers can exploit to trigger an OutOfMemoryError and terminate the application bsc1275912...