Malicious code in install-native-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 757eb666248556142f82ce2793cd42e7e30db4ce65efc823eaed2a71c14087f2 lib/report.js collects host and user identifying data via os.hostname, os.userInfo, execSync-invoked system commands, and fs.readFileSync of local...

MAL-2026-11468 Malicious code in install-native-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 757eb666248556142f82ce2793cd42e7e30db4ce65efc823eaed2a71c14087f2 lib/report.js collects host and user identifying data via os.hostname, os.userInfo, execSync-invoked system commands, and fs.readFileSync of local...

[SECURITY] Fedora 43 Update: pack-0.40.8-1.fc43

pack is a CLI implementation of the Platform Interface Specification for Cloud Native Buildpacks...

[SECURITY] Fedora 44 Update: pack-0.40.8-1.fc44

pack is a CLI implementation of the Platform Interface Specification for Cloud Native Buildpacks...

SUSE SLED15 / SLES15 Security Update : liboqs, oqs-provider (SUSE-SU-2026:3420-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3420-1 advisory. - disable KEMHQC and SIGMQOM and KEMNTRUPRIME on s390x for now, testsuite shows them not working. Updated to...

Security update for liboqs, oqs-provider

This update for liboqs, oqs-provider fixes the following issues: disable KEMHQC and SIGMQOM and KEMNTRUPRIME on s390x for now, testsuite shows them not working. Updated to 0.16.0: Deprecation notice: SPHINCS+ was removed in 0.16.0. Security issues: Fixed uninitialized encapsderand pointer...

Pillow: Pillow: Native heap out-of-bounds write

A flaw was found in Pillow prior to 12.3.0. The public RankFilter API can trigger a native heap out-of-bounds write when given a very large odd filter size. ImageFilter.RankFilter.filter calls image.expandsize // 2, size // 2 before rank-filter size validation, and ImagingExpand computes output...

RHEL 10 : mariadb-connector-c (RHSA-2026:47772)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:47772 advisory. The MariaDB Native Client library C driver is used to connect applications developed in C/C++ to MariaDB and MySQL databases. Security Fixes:...

CVE-2026-56745

A flaw was found in Netty. A remote attacker can exploit a vulnerability in the SpdyHttpDecoder handler of Netty's SPDY-to-HTTP codec. When processing a client-initiated SYNSTREAM frame, the decoder fails to release allocated memory if the stream is reset or content limits are exceeded. This...

MAL-2026-11094 Malicious code in cfgzen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a904eba641878bae63f76595a468b0faaa66fd27104ac557249e457f005c3fb1 The package installs a site-wide cfgzen.pth containing import dotcfg, which Python's site machinery executes automatically at every interpreter start...

Malicious code in cfgzen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a904eba641878bae63f76595a468b0faaa66fd27104ac557249e457f005c3fb1 The package installs a site-wide cfgzen.pth containing import dotcfg, which Python's site machinery executes automatically at every interpreter start...

Qualys Expands Serverless Security with Vulnerability Scanning for AWS Lambda

Key Takeaways Qualys now delivers automated AWS Lambda vulnerability scanning , extending serverless security beyond posture checks CSPM into workload-level risk visibility. CSPM alone only catches misconfigurations excessive permissions, exposure, logging, encryption — it can't detect vulnerable...

CVE-2026-8484

A flaw was found in Jansi. A heap buffer overflow vulnerability exists in the Jansi Java Native Interface JNI 'ioctl' wrapper. This is due to a lack of size verification for the argument array before the system call, which can lead to heap corruption. An attacker could exploit this to cause...

UBUNTU-CVE-2026-64355

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast redirects clone the packet for all but the last destination. For native XDP, that clone path copies only the linear xdpframe data, while fragmented frames keep skbsharedinf...

CVE-2026-64355 bpf: Reject fragmented frames in devmap

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast redirects clone the packet for all but the last destination. For native XDP, that clone path copies only the linear xdpframe data, while fragmented frames keep skbsharedinf...

EUVD-2026-48899

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast redirects clone the packet for all but the last destination. For native XDP, that clone path copies only the linear xdpframe data, while fragmented frames keep skbsharedinf...

CVE-2026-64355 bpf: Reject fragmented frames in devmap

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast redirects clone the packet for all but the last destination. For native XDP, that clone path copies only the linear xdpframe data, while fragmented frames keep skbsharedinf...

CVE-2026-64355: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject fragmented frames in devmap Devmap broadcast redirects clone the packet for all but the last destination. For native XDP, that clone path copies only the linear xdpframe data, while fragmented frames keep skbsharedinf...

GHSA-GCJH-H69Q-9W9G cel-go: JSON Private Fields Exposed via NativeTypes and ParseStructTag

The function ext.NativeTypesParseStructTag"json" does not honour the encoding/json skip directive json:"-". Fields tagged json:"-" are registered in the CEL type system under the literal name "-" and are readable from any user-submitted CEL expression via dynobj"-". Additionally, newNativeTypes...

LZ4 Java: Native XXHash implementations can crash the JVM when passed invalid byte array ranges

Summary Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the...