Malicious code in skillspector (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c77584b4e40db9023ca0b8a90fa1bd611c859ed486f99ca3a7c9a83dbfa9877 This package presents itself as a redistribution of NVIDIA/skillspector pyproject Homepage points to github.com/NVIDIA/skillspector and the source...

MAL-2026-6561 Malicious code in skillspector (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c77584b4e40db9023ca0b8a90fa1bd611c859ed486f99ca3a7c9a83dbfa9877 This package presents itself as a redistribution of NVIDIA/skillspector pyproject Homepage points to github.com/NVIDIA/skillspector and the source...

MAL-2026-6550 Malicious code in @k18n/creatormarketplace-admin-language (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6213acbcf6c562c8a7690e6018490d502d8df9377a2ed85c5bca9d828ed261c8 Package claims the @k18n npm scope used internally by Kuaishou and publishes at version 99.0.0 — the canonical high-version dependency-confusion shap...

Malicious code in @k18n/creatormarketplace-admin-language (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6213acbcf6c562c8a7690e6018490d502d8df9377a2ed85c5bca9d828ed261c8 Package claims the @k18n npm scope used internally by Kuaishou and publishes at version 99.0.0 — the canonical high-version dependency-confusion shap...

CVE-2026-46604 vulnerabilities

Vulnerabilities for packages: rclone, mattermost-fips, listmonk, seaweedfs-operator-fips, seaweedfs-operator, seaweedfs, gitlab-workhorse-ce, rclone-fips, seaweedfs-fips, mattermost, hugo...

GHSA-QVQC-4C52-X6QP vulnerabilities

Vulnerabilities for packages: guac, kube-arangodb, gpu-operator, gpu-operator-fips, kube-arangodb-fips...

CVE-2026-49349 vulnerabilities

Vulnerabilities for packages: guac, kube-arangodb, gpu-operator, gpu-operator-fips, kube-arangodb-fips...

Linux Distros Unpatched Vulnerability : CVE-2026-9640

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restricti...

Malicious code in ts-ankle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1695e2ffa9252abe1053fc13895a071bd87cb27eb009eeb2262aae1a27da4ea5 On npm install, [email protected] runs a postinstall hook node test.js that executes two hostile flows against the installer's machine without user...

MAL-2026-6548 Malicious code in ts-ankle (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1695e2ffa9252abe1053fc13895a071bd87cb27eb009eeb2262aae1a27da4ea5 On npm install, [email protected] runs a postinstall hook node test.js that executes two hostile flows against the installer's machine without user...

pagecache-lpe-containment-kit

Page-Cache LPE Containment Kit Detect, contain, and verify...

Authorization Bypass

Apache Camel is vulnerable to Authorization Bypass. The vulnerability is due to insufficient validation of user-controlled Build resources, which allows an authorized attacker to generate Pods in arbitrary Kubernetes namespaces, including the operator namespace...

CVE-2026-39395 vulnerabilities

Vulnerabilities for packages: slsa-verifier, trivy-fips, kyverno-fips, ratify-fips, commercial-chainloop-cli, teleport, zot, kyverno-notation-aws, policy-controller, commercial-chainloop-backend, policy-controller-fips, kubescape-server-fips, crossplane-fips, cloudbeat-fips, kyverno, ratify,...

GHSA-W6C6-C85G-MMV6 vulnerabilities

Vulnerabilities for packages: slsa-verifier, trivy-fips, kyverno-fips, ratify-fips, commercial-chainloop-cli, teleport, zot, kyverno-notation-aws, policy-controller, commercial-chainloop-backend, policy-controller-fips, kubescape-server-fips, crossplane-fips, cloudbeat-fips, kyverno, ratify,...

CVE-2026-39395 vulnerabilities

Vulnerabilities for packages: teleport, policy-controller, kubescape, trivy-operator, kyverno, zot, ratify, kyverno-notation-aws, trivy, slsa-verifier, crossplane, aactl...

GHSA-W6C6-C85G-MMV6 vulnerabilities

Vulnerabilities for packages: teleport, policy-controller, kubescape, trivy-operator, kyverno, zot, ratify, kyverno-notation-aws, trivy, slsa-verifier, crossplane, aactl...

SUSE CVE-2026-47770

jq is a command-line JSON processor. Prior to 1.8.2, comparing two sufficiently deeply nested arrays with the == operator exhausts the C stack on jq's ordinary command-line surface, resulting in denial of service via stack exhaustion uncontrolled recursion. The crash occurs in jq's recursive...

EulerOS 2.0 SP15 : python3 (EulerOS-SA-2026-2507)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update, |= operator, and unpickli...

EulerOS 2.0 SP15 : python3 (EulerOS-SA-2026-2466)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The fix for CVE-2026-0672, which rejected control characters in http.cookies.Morsel, was incomplete. The Morsel.update, |= operator, and unpickli...

GHSA-X6FG-52VR-HJ4W Nezha Monitoring: Authenticated users can claim the dashboard Host through NAT and preempt all dashboard routing

Summary An authenticated non-admin user who owns any server can create or update a NAT profile whose domain is equal to the dashboard's own HTTP Host for example, dashboard.example:8008. The dashboard's top-level HTTP/gRPC multiplexer checks NATShared.GetNATConfigByDomainr.Host before dispatching...