MAL-2026-10228 Malicious code in chat-adapter-zoom (npm)

The chat-adapter-zoom package was published to the npm registry by user 'click2ai' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign. The package name mimics the internal/private package naming convention of a target organization a Zoom...

PT-2026-59564

Summary Type: Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspace id/projects/project id and GET .../project id/stats gate access on require workspace memberworkspace id only, then resolve project id through ProjectService.getproject id /...

RHEL 9 : openexr (RHSA-2026:38498)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:38498 advisory. OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document...

RHEL 10 : openexr (RHSA-2026:39024)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39024 advisory. OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document...

RHEL 10 : plexus-utils (RHSA-2026:38514)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:38514 advisory. The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for ...

RHEL 9 : xorg-x11-server-Xwayland (RHSA-2026:38490)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:38490 advisory. Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer...

RHEL 9 : compat-openssl11 (RHSA-2026:39012)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:39012 advisory. The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the librarie...

RHEL 9 : perl-DBI (RHSA-2026:38512)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:38512 advisory. DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions,...

RHEL 9 : freeipmi (RHSA-2026:39008)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39008 advisory. The freeipmi packages contain an Intelligent Platform Management Interface IPMI remote console and system management software based on the...

RHEL 9 : buildah (RHSA-2026:38493)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:38493 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working...

RHEL 9 : gegl04 (RHSA-2026:38497)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:38497 advisory. GEGL Generic Graphics Library is a graph-based image processing framework. Security Fixes: gimp: GIMP: Arbitrary code execution via heap-based buffe...

RHEL 8 : xorg-x11-server (RHSA-2026:38487)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:38487 advisory. X.Org is an open-source implementation of the X Window System. It provides the basic low-level functionality that full-fledged graphical user...

RHEL 9 : kernel (RHSA-2026:38902)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:38902 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ima: don't clear IMADIGSIG fl...

RHEL 9 : compat-openssl11 (RHSA-2026:39009)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:39009 advisory. The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the librarie...

RHEL 7 : firefox (RHSA-2026:38506)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:38506 advisory. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox:...

RHEL 9 : freeipmi (RHSA-2026:39006)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:39006 advisory. The freeipmi packages contain an Intelligent Platform Management Interface IPMI remote console and system management software based on the...

RHEL 8 : nginx:1.24 (RHSA-2026:38847)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:38847 advisory. nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security...

RHEL 9 : libreoffice (RHSA-2026:38508)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:38508 advisory. LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a...

RHEL 10 : xorg-x11-server-Xwayland (RHSA-2026:38489)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:38489 advisory. Xwayland is an X server for running X clients under Wayland. Security Fixes: xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer...

BIT-AIRFLOW-2026-49487 Apache Airflow: Task-instance API exposes secrets in deferred trigger kwargs

In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking. When a deferred operator passed a secret for example a provider API key into its trigger, any authenticated user with DAG-scoped task-instance read acces...