postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle

A flaw was found in PostgreSQL. This vulnerability, caused by type confusion in the 'portal'/cursor lifecycle, allows a user to execute arbitrary code as the operating system user running the database. This can occur by re-creating a cursor or other portal with different types. Successful...

Malicious code in focaleys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 481093b5037c8aafc763d4543e5a6a39c2ebc7055673eb1d4f480f885593bcd2 package.json declares the dependency 'libsignal' as 'github:rexxzyid/libsignal-node' with no tag, version, or commit SHA. On npm install, this resolv...

Malicious code in fca-raihan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 241006adda5ea773d76d48d874c80a4054215ed18f05de3e392cdd86c0379785 package.json for fca-raihan declares a dependency whose key equals the package's own name fca-raihan with source github:raihan9099/fca-raihan. This i...

Malicious code in test-supply-npm-lib-4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44f10381ad047460986bbeedafad42f8c71db61fff98fe07c915cd0d3678d268 package.json declares a dependency sourced from a git URL git+https://[email protected]/agustedone/test-supply-npm-git-prepare-proof-4.git pinned to...

MAL-2026-17311 Malicious code in itsmeeaizat-bailey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e87b4292727088efa5df8326a5f868b2c6bb3ae66ee15cecc18f2fa899296075 package.json declares the libsignal dependency as git+https://github.com/whiskeysockets/libsignal-node with no tag, no commit SHA, and no integrity...

Malicious code in mfahelper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6df54a49845aa55e3310261ccc7002fe5aabcdf3924875bf7c1ad3fb4751297 package.json declares its only runtime dependency, node-net-pool, as an https tarball pointing at the main branch of an unrelated GitHub account...

MAL-2026-17308 Malicious code in mfahelper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6df54a49845aa55e3310261ccc7002fe5aabcdf3924875bf7c1ad3fb4751297 package.json declares its only runtime dependency, node-net-pool, as an https tarball pointing at the main branch of an unrelated GitHub account...

CVE-2026-102823

A flaw was found in russh, a Secure Shell SSH client and server library. When communicating with a client, a malicious SSH server can send channel lifecycle events referencing unverified, unopened, or closed channel identifiers. Because the library forwards these events to client handlers without...

CVE-2026-102823

Russh is a Rust SSH client and server library. Prior to 0.63.1, clientreadauthenticated in russh/src/client/encrypted.rs forwards CHANNELDATA, CHANNELEXTENDEDDATA, CHANNELEOF, CHANNELCLOSE, CHANNELOPENFAILURE, CHANNELSUCCESS, CHANNELFAILURE, and CHANNELREQUEST subtypes exit-status, exit-signal, a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16 CNF vRAN extras topology aware lifecycle manager update

An update for topology-aware-lifecycle manager is available for Red Hat OpenShift Container Platform 4.16. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21 CNF vRAN extras topology aware lifecycle manager update

An update for topology-aware-lifecycle manager is available for Red Hat OpenShift Container Platform 4.21. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22 CNF vRAN extras topology aware lifecycle manager update

An update for topology-aware-lifecycle manager is available for Red Hat OpenShift Container Platform 4.22. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the...

Malicious code in exptrdd (npm)

The package exptrdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in xeprews (npm)

The package xeprews impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17247 Malicious code in exptredd (npm)

The package exptredd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in react-nodejs (npm)

The package react-nodejs impersonates the legitimate 'react' package it republishes react's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in exptredd (npm)

The package exptredd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

Malicious code in exprdd (npm)

The package exprdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

MAL-2026-17241 Malicious code in exprdd (npm)

The package exprdd impersonates the legitimate 'express' package it republishes express's package metadata and code and adds a malicious preinstall hook that runs automatically on npm install, before any dependency is installed: curl...

postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle

A flaw was found in PostgreSQL. This vulnerability, caused by type confusion in the 'portal'/cursor lifecycle, allows a user to execute arbitrary code as the operating system user running the database. This can occur by re-creating a cursor or other portal with different types. Successful...