postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module

A flaw was found in PostgreSQL. A type confusion vulnerability in the 'refint' module allows an object creator to execute arbitrary code as the operating system user running the database. This could lead to a complete compromise of the database server...

CVE-2026-92957

A flaw was found in vm2. Untrusted code running within the sandbox can bypass module restriction policies to achieve arbitrary code execution on the underlying host. Due to improper normalization of module names containing the node: prefix, deny-list rules fail to prevent access to sensitive...

CVE-2026-92941

A flaw was found in vm2. The sandbox improperly exposes the host Transport Layer Security TLS module to untrusted code running within the sandbox environment. An attacker can exploit this issue using allowed built-in utilities to modify the process-wide certificate authorities. This manipulation...

CVE-2026-92948

A flaw was found in vm2. This vulnerability allows an attacker with permission to run code inside the sandbox to escape containment and achieve arbitrary code execution on the host system. Due to improper validation of built-in module names, the sandbox fails to block access to sensitive host...

Malicious Package

Overview @redman89405/my-module is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious code in @redman89405/my-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee7d38498dcd2e2a3afc4ed3b3a5136cb88e11693ef59fc7676bf35cd89b932c The package ships code.png alongside index.js and exports a function imageToCode that reads a length-prefixed byte stream from the first pixel row of...

MAL-2026-17336 Malicious code in @redman89405/my-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee7d38498dcd2e2a3afc4ed3b3a5136cb88e11693ef59fc7676bf35cd89b932c The package ships code.png alongside index.js and exports a function imageToCode that reads a length-prefixed byte stream from the first pixel row of...

CVE-2026-103054

AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. Attackers can submit tenant UUIDs via the addtenantstoportfolio endpoint to claim unclaimed tenants and read their securit...

[SECURITY] Fedora 43 Update: libxmp-4.7.3-1.fc43

Libxmp is a library that renders module files to PCM data. It supports over 90 mainstream and obscure module formats including Protracker MOD, Scream Tracker 3 S3M, Fast Tracker II XM, and Impulse Tracker IT. Many compressed module formats are supported, including popular Unix, DOS, and Amiga fil...

[SECURITY] Fedora 43 Update: perl-Imager-1.036-1.fc43

Imager is a module for creating and altering images. It can read and write various image formats, draw primitive shapes like lines,and polygons, blend multiple images together in various ways, scale, crop, render text and more...

CLEANSTART-2026-DB44167 malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go ...

Security vulnerability affects the minio-operator package. A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache...

CLEANSTART-2026-TO10251 malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log

Security vulnerability affects the minio-operator package. A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log...

EUVD-2026-89538

AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. Attackers can submit tenant UUIDs via the addtenantstoportfolio endpoint to claim unclaimed tenants and read their securit...

CVE-2026-103054

AiSOC versions before 12.0.0 contain an authorization bypass vulnerability within the MSSP module . This flaw allows authenticated users to submit tenant UUIDs via the add_tenants_to_portfolio endpoint, enabling them to claim unclaimed tenants and access sensitive data, including security alerts,...

CVE-2026-103054 AiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSP

AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. Attackers can submit tenant UUIDs via the addtenantstoportfolio endpoint to claim unclaimed tenants and read their securit...

CVE-2026-103054 AiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSP

AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. Attackers can submit tenant UUIDs via the addtenantstoportfolio endpoint to claim unclaimed tenants and read their securit...

PT-2026-103433

🚨 CVE-2026-47585 NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause an integer underflow. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, an...

AlmaLinux 9.2 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.2:CLSA-2025:1736503464)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1736503464 advisory. - A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not...

CentOS Linux 8.4 [TuxCare] Security Update: platform-python / platform-python-debug / platform-python-devel / etc (CENTOS8.4:CLSA-2026:1781083779)

The CentOS Linux 8.4 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1781083779 advisory. - The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as...

Rocky Linux 9.6 [TuxCare] Security Update: opensc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1778493745)

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1778493745 advisory. - A vulnerability was found in OpenSC, OpenSC tools, PKCS11 module, minidriver, and CTK. The problem is missing initialization of...