Malicious code in tailwind-utility-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 39d25399b925f6d37feda28b303576e2ad1672667a44ba9708f5e0ee213089ff The package is advertised as a Tailwind CSS utility library, but the default export assembles a URL from split fragments resolving to...

Malicious code in tailwind-extension-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7048fbbdab179b32cf7705e06d396bc0fb6a04df45872a6119324a545d8d03db Package is presented as a Tailwind CSS utility, but its default export getPlugin fetches JSON from a hardcoded bare-IP endpoint...

MAL-2026-14189 Malicious code in tailwind-extension-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7048fbbdab179b32cf7705e06d396bc0fb6a04df45872a6119324a545d8d03db Package is presented as a Tailwind CSS utility, but its default export getPlugin fetches JSON from a hardcoded bare-IP endpoint...

When Agents Go Rogue: The OpenClaw Supply Chain Crisis

When Agents Go Rogue: The OpenClaw Supply Chain Crisis By Aniket Choukde, Vikas Mishra and Yadunadh · August 19, 2026 This blog was also written by Akhil Reddy and Pavan Kumar Podila Executive Summary The cybersecurity landscape is currently undergoing a seismic shift driven by the adoption of...

AlmaLinux 9 : php:8.3 (ALSA-2026:48197)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:48197 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.3.32 for...

Linux Distros Unpatched Vulnerability : CVE-2026-15806

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take...

PT-2026-78408

Name of the Vulnerable Software and Affected Versions Renovate versions 43.65.0 through 43.102.10 Description A remote code execution issue exists in the bazel-module and bazelisk managers when the lockFileMaintenance feature is enabled. An attacker can execute arbitrary code by supplying malicio...

PT-2026-78324

Name of the Vulnerable Software and Affected Versions mod cluster affected versions not specified Description A flaw exists in the AdvertiseListenerImpl of the org.jboss.modcluster core module. An unauthenticated attacker can cause a denial of service by sending a single crafted UDP multicast...

Linux Distros Unpatched Vulnerability : CVE-2026-34789

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, src/App/PropertyPythonObject.cpp in PropertyPythonObject::Restore passes...

MiracleLinux 8 : pam-1.3.1-40.el8_10 (AXSA:2026-1577:02)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1577:02 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block direct...

RockyLinux 8 : pam (RLSA-2026:56131)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:56131 advisory. linux-pam: Plaintext password recovery via timing discrepancy in pamuserdb module CVE-2026-54411 Tenable has extracted the preceding description block directly...

RockyLinux 8 : mysql:8.4 (RLSA-2026:56936)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:56936 advisory. mysql: Performance Schema unspecified vulnerability CPU Jul 2026 CVE-2026-61081 mysql: Optimizer unspecified vulnerability CPU Jul 2026 CVE-2026-47064...

RHEL 9 : mysql:8.4 (RHSA-2026:56973)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56973 advisory. MySQL is a multi-user, multi-threaded SQL database server. It consists of the MySQL server daemon mysqld and many client programs and...

PT-2026-78550

Name of the Vulnerable Software and Affected Versions Orval versions 8.19.0 through 8.20.x Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A double quote in a schema property name is emitted into the generated zod.object...

PT-2026-78554

Name of the Vulnerable Software and Affected Versions Orval versions prior to 8.21.0 Description Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. A flaw exists where a $... expression or backtick in a header parameter default is emitted int...

Fedora 43 : perl-Imager (2026-4fb0f012fb)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-4fb0f012fb advisory. Upstream changes 1.034: - Security fix: EXIF: fix decoding of ASCII fields with zero size CVE-2026-19082, GHSA-hx46-55wp-hv6m - JPEG: depend on Imager 1.034...

Fedora 44 : perl-Imager (2026-8a61adae6f)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-8a61adae6f advisory. Upstream changes 1.034: - Security fix: EXIF: fix decoding of ASCII fields with zero size CVE-2026-19082, GHSA-hx46-55wp-hv6m - JPEG: depend on Imager 1.034...

Linux Distros Unpatched Vulnerability : CVE-2026-75926

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the...

SUSE SLES15 Security Update : rsync (SUSE-SU-2026:3634-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3634-1 advisory. - CVE-2026-53783: rrsync restricted-directory escape validation-vs-exec race + unsafe option allowlist bsc1269041. - CVE-2026-53784...

MiracleLinux 9 : nginx:1.26 (AXSA:2026-1551:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1551:01 advisory. nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers CVE-2026-42055 Tenable has extracted t...