molecule-26.8.0-1.1 on GA media (moderate)

molecule-26.8.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11507-1 Rating: moderate Cross-References: CVE-2026-11332 CVSS scores: CVE-2026-11332 SUSE : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be...

PT-2026-76433

These are all security issues fixed in the molecule-26.8.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11507-1 molecule-26.8.0-1.1 on GA media

These are all security issues fixed in the molecule-26.8.0-1.1 package on the GA media of openSUSE Tumbleweed...

Malicious code in checkout-molecule-desktop-status-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be057846e34bed91c3f790d1c7d61a9720d8188c755a370ab9edb8f02b732247 The package's main entry index.js requires./polyfill on load. polyfill.js immediately runs an async routine that reconstructs several hostnames from...

MAL-2026-12581 Malicious code in checkout-molecule-desktop-status-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be057846e34bed91c3f790d1c7d61a9720d8188c755a370ab9edb8f02b732247 The package's main entry index.js requires./polyfill on load. polyfill.js immediately runs an async routine that reconstructs several hostnames from...

Malicious code in checkout-molecule-mobile-status-sheet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d49254998829dd2e5809cd78290939f76e37c2c82dcb75d4331703522b95adb0 On require of this package, index.js unconditionally loads compat.js, which fetches a platform-specific executable from hardcoded Cloudflare Workers...

ci-buildbot (>=0.4.0, <=0.11.5), molecule (>=3.0.5, <=3.1.5) +2 more potentially affected by CVE-2026-54552 via sh (1.13.1)

sh PYPI version 1.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on sh and may be impacted: - ci-buildbot =0.4.0, =3.0.5, =0.0.0.dev0, =0.1.9, =0.1.12 Source cves: CVE-2026-54552 Source advisory: OSV:GHSA-Q38V-WP89-2W55...

PYSEC-2026-2789 Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule

Summary A memory-safety vulnerability in Open Babel's GAMESS output parser caused a use-after-free when reading a crafted input file. Details The flaw was in GAMESSOutputFormat::ReadMolecule. A malformed input caused the parser to dereference a stale pointer after the underlying object had been...

Boltz contains an insecure deserialization vulnerability in its molecule loading functionality

Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecule data files without validation. An attacker with the ability to place a malicious pickle file in a directory processed by boltz can achie...

ome-ansible-molecule (>=0.5.0, <=0.5.2) potentially affected by CVE-2025-14010 via ansible (2.8.18)

ansible PYPI version 2.8.18 is affected by a known vulnerability. The following packages have a transitive dependency on ansible and may be impacted: - ome-ansible-molecule =0.5.0, =0.5.2 Source cves: CVE-2025-14010 Source advisory: OSV:PYSEC-2026-1119...

ome-ansible-molecule (0.4.4) potentially affected by CVE-2025-14010 via ansible (2.6.18)

ansible PYPI version 2.6.18 is affected by a known vulnerability. The following packages have a transitive dependency on ansible and may be impacted: - ome-ansible-molecule 0.4.4 Source cves: CVE-2025-14010 Source advisory: OSV:PYSEC-2026-1119...

ome-ansible-molecule (0.4.4) potentially affected by CVE-2023-5115 via ansible (2.6.18)

ansible PYPI version 2.6.18 is affected by a known vulnerability. The following packages have a transitive dependency on ansible and may be impacted: - ome-ansible-molecule 0.4.4 Source cves: CVE-2023-5115 Source advisory: OSV:PYSEC-2026-1120...

ome-ansible-molecule (>=0.5.0, <=0.5.2) potentially affected by CVE-2023-5115 via ansible (2.8.18)

ansible PYPI version 2.8.18 is affected by a known vulnerability. The following packages have a transitive dependency on ansible and may be impacted: - ome-ansible-molecule =0.5.0, =0.5.2 Source cves: CVE-2023-5115 Source advisory: OSV:PYSEC-2026-1120...

EUVD-2025-31200

Open Babel has Use-after-free in GAMESS GAMESSOutputFormat::ReadMolecule...

PT-2026-45893

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=515663946 Crash type: Container-overflow READ 1 Crash state: OpenBabel::MDLFormat::ReadV3000Block OpenBabel::MDLFormat::ReadMolecule OpenBabel::OBConversion::Read...

openbabel:fuzz_molecule: Heap-use-after-free in OpenBabel::OBAngleData::FillAngleArray

Project: https://github.com/openbabel/openbabel.git Detailed Report: https://oss-fuzz.com/testcase?key=5045393024155648 Project: openbabel Fuzzing Engine: afl Fuzz Target: fuzzmolecule Job Type: aflasanopenbabel Platform Id: linux Crash Type: Heap-use-after-free READ 4 Crash Address: 0x7707b57e18...

CVE-2025-70560

Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecule data files without validation. An attacker with the ability to place a malicious pickle file in a directory processed by boltz can achie...

GHSA-FJM6-8XP2-4FWC Boltz contains an insecure deserialization vulnerability in its molecule loading functionality

Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecule data files without validation. An attacker with the ability to place a malicious pickle file in a directory processed by boltz can achie...

Boltz contains an insecure deserialization vulnerability in its molecule loading functionality

Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecule data files without validation. An attacker with the ability to place a malicious pickle file in a directory processed by boltz can achie...

CVE-2025-70560

Boltz 2.0.0 contains an insecure deserialization vulnerability in its molecule loading functionality. The application uses Python pickle to deserialize molecule data files without validation. An attacker with the ability to place a malicious pickle file in a directory processed by boltz can achie...