Rocky Linux 9 [CIQ] Security Update: libeconf / libeconf-debuginfo / libeconf-debugsource (crlsa-2023_4347)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20234347 advisory. libeconf: stack-based buffer overflow in readfile in lib/getfilecontents.c CVE-2023-22652 Tenable has extracted the preceding description block directly from the CI...

Rocky Linux 9 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2026_47040)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202647040 advisory. kernel: xfrm: Duplicate SPI Handling CVE-2025-39797 kernel: lib/buildid: use kernelread for sleepable context CVE-2026-23002 kernel: futex: Drop CLONETHRE...

Rocky Linux 9 [CIQ] Security Update: python-unversioned-command / python3 / python3-debug / etc Multiple Vulnerabilities (crlsa-2022_8353)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20228353 advisory. python: mailcap: findmatch function does not sanitize the second argument CVE-2015-20107 python: open redirection vulnerability in lib/http/server.py may...

CentOS Linux 7 [TuxCare] Security Update: emacs / emacs-common / emacs-el / emacs-filesystem / emacs-nox / etc (CENTOS7:CLSA-2024:1727287647)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1727287647 advisory. - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c...

Rocky Linux 8 [CIQ] Security Update: platform-python / platform-python-debug / platform-python-devel / etc Multiple Vulnerabilities (crlsa-2023_0833)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20230833 advisory. python: int type in PyLongFromString does not limit amount of digits converting text to int leading to DoS CVE-2020-10735 python: open redirection...

Rocky Linux 9 [CIQ] Security Update: openjpeg2 / openjpeg2-debuginfo / openjpeg2-debugsource / etc Multiple Vulnerabilities (crlsa-2025_7309)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20257309 advisory. openjpeg: heap buffer overflow in bin/common/color.c CVE-2024-56826 openjpeg: heap buffer overflow in lib/openjp2/j2k.c CVE-2024-56827 Tenable has extracte...

Rocky Linux 8 [CIQ] Security Update: Cython-debugsource / PyYAML-debugsource / python-cffi-debugsource / etc Multiple Vulnerabilities (crlsa-2023_2763)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20232763 advisory. python: int type in PyLongFromString does not limit amount of digits converting text to int leading to DoS CVE-2020-10735 python: open redirection...

lib/adapters/http.js file in the Information Disclosure

The vulnerability of the lib/adapters/http.js file in the axios library is related to uncontrolled changes to object prototype attributes. Exploiting this vulnerability could allow a remote attacker to disclose sensitive information that is protected by this security measure...

lib/resolver-compat.js Code Execution

The vulnerability of the LegacyResolver.customResolve function in the lib/resolver-compat.js file of the NodeVM library’s vm2 module is related to authentication process vulnerabilities. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

axios shouldBypassProxy function DoS

The vulnerability of the shouldBypassProxy function in the axios library’s lib/helpers/shouldBypassProxy.js file is related to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability could allow an attacker to cause service failures...

axios Heap Buffer Overflow DoS

The vulnerability of the axios.get function in the axios library’s lib/helpers/fromDataURI.js file is related to the use of a regular expression with inefficient computational complexity. Exploiting this vulnerability could allow an attacker to cause service failures remotely...

automatic-spike-detection (>=1.0.0b0, <=1.2.4), snraspi-lib (1.0.6) +1 more potentially affected by CVE-2026-102930 via virtualenv (20.24.4)

virtualenv PYPI version 20.24.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - automatic-spike-detection =1.0.0b0, =5.0.0, =5.0.1 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...

automatic-spike-detection (>=1.0.0b0, <=1.2.4), snraspi-lib (1.0.6) +1 more potentially affected by CVE-2026-102938 via virtualenv (20.24.4)

virtualenv PYPI version 20.24.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - automatic-spike-detection =1.0.0b0, =5.0.0, =5.0.1 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

EUVD-2026-88382

Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection...

Improper Isolation or Compartmentalization

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization in lib/helpers/shouldBypassProxy.js, which matches NOPROXY entries by exact host or IP and has no parsing for...

Improper Isolation or Compartmentalization

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization in lib/helpers/shouldBypassProxy.js, which matches NOPROXY entries by exact host or IP and has no parsing for CIDR notation, so...

Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Summary Axios for Node.js parses data: URLs in lib/helpers/fromDataURI.js. The current RFC-2397 parser uses a regular expression whose media type groups allow / inside both sides of the type/subtype match. A malformed data: URL containing many slashes and no comma forces the JavaScript regex engi...

SUSE CVE-2026-102414

pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback lib/sync.js. A password longer than the block size 64 bytes, or 128 bytes for sha384 and sha512 is passed to HMAC as the key on every iteration, and HMAC hashes such keys in...

@hilla/react-components (>=1.3.0-alpha3, <=1.6.4), @majinno/vaadin-components-import (>=1.0.1, <=1.0.16) +4 more potentially affected by CVE-2026-91860 via @vaadin/charts (>=23.0.0, <=23.6.4)

@vaadin/charts NPM version =23.0.0, =1.3.0-alpha3, =1.0.1, =23.0.0, =23.0.14, =1.0.2, =1.0.2, =1.0.3 Source cves: CVE-2026-91860 Source advisory: MEND:CVE-2026-91860...

Malicious Package

Overview test-supply-npm-lib-4 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...