MAL-2026-15694 Malicious code in circle-w3s (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-15693 Malicious code in py-devoli-common (PyPI)

--- -= Per source details. Do not edit below this line.=-...

ROOT-OS-DEBIAN-13-CVE-2026-49295 CVE-2026-49295 in libde265 - Patched by Root

Root has patched CVE-2026-49295 in the libde265 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2025-61147 CVE-2025-61147 in libde265 - Patched by Root

Root has patched CVE-2025-61147 in the libde265 package for Root:Debian:13. Multiple fixed versions available...

ROOT-OS-DEBIAN-13-CVE-2026-21413 CVE-2026-21413 in libraw - Patched by Root

Root has patched CVE-2026-21413 in the libraw package for Root:Debian:13. Multiple fixed versions available...

CGA-8882-634R-3V97

Bulletin has no description...

CGA-GQ6P-W45V-M44W

Bulletin has no description...

CGA-7WPW-PVRC-6P82

Bulletin has no description...

CGA-9CVM-Q3FR-627V

Bulletin has no description...

CGA-58M2-CFC4-5G8G

Bulletin has no description...

@diviops/mcp-server (1.5.40), @donadiosolutions/lcm (>=1.4.2, <=1.4.3) +18 more potentially affected by CVE-2026-75899 via fast-uri (>=3.1.2, <=3.1.5)

fast-uri NPM version =3.1.2, =1.4.2, =1.2.0, =1.4.18, =0.2.0-alpha.5, =0.1.0, =0.1.6, =0.16.2-cloud-1, =1.25.0, =0.1.5, =0.1.3, =3.38.11, =0.1.0, =0.1.0, =0.1.3 and more Source cves: CVE-2026-75899 Source advisory: SNYK:JS-FASTURI-19256873...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @diviops/mcp-server (1.5.40) +24 more potentially affected by CVE-2026-75975 via fast-uri (>=3.0.1, <=3.1.5)

fast-uri NPM version =3.0.1, =0.3.1, =1.4.2, =1.2.0, =1.4.18, =5.4.3, =0.2.0-alpha.5, =0.1.0, =1.0.0, =1.0.0, =0.1.6, =0.16.2-cloud-1, =1.25.0, =1.28.1 and more Source cves: CVE-2026-75975 Source advisory: SNYK:JS-FASTURI-19256871...

UBUNTU-CVE-2026-65053

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...

MINI-4R4P-2V5H-FRGV

Bulletin has no description...

MINI-8GV3-HP78-44RM

Bulletin has no description...

MINI-QJ4J-398G-G5R8

Bulletin has no description...

MINI-G36Q-J9FR-G6MX

Bulletin has no description...

MINI-PRC8-548X-VVQP

Bulletin has no description...

MINI-Q456-7PMH-JJG9

Bulletin has no description...

DEBIAN-CVE-2026-78367

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand as part of a %basename:... macro expression. A specially crafted .spec member...