Malicious code in tailwind-extension-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7048fbbdab179b32cf7705e06d396bc0fb6a04df45872a6119324a545d8d03db Package is presented as a Tailwind CSS utility, but its default export getPlugin fetches JSON from a hardcoded bare-IP endpoint...

MAL-2026-14189 Malicious code in tailwind-extension-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7048fbbdab179b32cf7705e06d396bc0fb6a04df45872a6119324a545d8d03db Package is presented as a Tailwind CSS utility, but its default export getPlugin fetches JSON from a hardcoded bare-IP endpoint...

PT-2026-78554

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A flaw exists where a $... expression or backtick in a header parameter default is emitted int...

UBUNTU-CVE-2026-15806

The HTTPPasswordMgr class in the urllib.request module, along with its...

PT-2026-78324

Name of the Vulnerable Software and Affected Versions mod cluster affected versions not specified Description A flaw exists in the AdvertiseListenerImpl of the org.jboss.modcluster core module. An unauthenticated attacker can cause a denial of service by sending a single crafted UDP multicast...

PT-2026-78550

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. From version 8.19.0 until 8.21.0, a double quote in a schema property name is emitted into the generated zod.object... schema without safe encoding. This permits attacker-controlled JavaScrip...

CVE-2026-15806

The HTTPPasswordMgr class in the urllib.request module, along with its...

UBUNTU-CVE-2026-17084

The "stringprep" module didnt process characters from RFC 3454 tables...

CVE-2026-17084

The "stringprep" module didnt process characters from RFC 3454 tables...

PT-2026-78408

Name of the Vulnerable Software and Affected Versions Renovate versions 43.65.0 through 43.102.10 Description A remote code execution issue exists in the bazel-module and bazelisk managers when the lockFileMaintenance feature is enabled. An attacker can execute arbitrary code by supplying malicio...

When Agents Go Rogue: The OpenClaw Supply Chain Crisis

When Agents Go Rogue: The OpenClaw Supply Chain Crisis By Aniket Choukde, Vikas Mishra and Yadunadh · August 19, 2026 This blog was also written by Akhil Reddy and Pavan Kumar Podila Executive Summary The cybersecurity landscape is currently undergoing a seismic shift driven by the adoption of...

Linux Distros Unpatched Vulnerability : CVE-2026-15806

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take...

RockyLinux 8 : pam (RLSA-2026:56131)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:56131 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block directly...

RHEL 8 : php:8.2 (RHSA-2026:47749)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:47749 advisory. PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: PHP OpenSSL extension: Denial of Service...

RockyLinux 8 : mysql:8.4 (RLSA-2026:56936)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:56936 advisory. mysql: Performance Schema unspecified vulnerability CPU Jul 2026 CVE-2026-61081 mysql: Optimizer unspecified vulnerability CPU Jul 2026 CVE-2026-47064...

MiracleLinux 8 : pam-1.3.1-40.el8_10 (AXSA:2026-1577:02)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1577:02 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block direct...

SUSE SLES15: libpython2_7-1_0 / python / python-base / python-curses / etc (SUSE-SU-2026:3635-1)

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3635-1 advisory. - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used...

AlmaLinux 8 : php:8.2 (ALSA-2026:47749)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:47749 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.2.32 for...

Linux Distros Unpatched Vulnerability : CVE-2026-34789

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore passes...

Fedora 43 : perl-Imager (2026-4fb0f012fb)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4fb0f012fb advisory. Upstream changes 1.034: - Security fix: EXIF: fix decoding of ASCII fields with zero size CVE-2026-19082, GHSA-hx46-55wp-hv6m - JPEG: depend on Imager 1.034...