Debian dsa-6452 : designate - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6452 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6452-1 [email protected] https://www.debian.org/securit...

MiracleLinux 9 : php:8.2 (AXSA:2026-1579:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1579:01 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Tenable has extracted the preceding description...

RHEL 8 : kpatch-patch-4_18_0-477_107_1, kpatch-patch-4_18_0-477_120_1, kpatch-patch-4_18_0-477_130_1, kpatch-patch-4_18_0-477_143_1, and kpatch-patch-4_18_0-477_97_1 (RHSA-2026:55761)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:55761 advisory. This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patc...

Debian dsa-6451 : firefox-esr - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6451 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6451-1 [email protected] https://www.debian.org/securit...

Linux Distros Unpatched Vulnerability : CVE-2026-75900

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An out-of-bounds read vulnerability was found in swtpm's SWTPMNVRAMCheckHeader function. The entry guard checks the buffer length against sizeofbh, where bh is ...

RockyLinux 8 : python3 (RLSA-2026:56219)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:56219 advisory. python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory CVE-2026-11940 Tenable has extracted the preceding descripti...

Fedora 44 : GitPython (2026-166bfc4f18)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-166bfc4f18 advisory. Update to 3.1.59 close RHBZ2499503 - Fixes GHSA-5xxx-qhh7-9287, GHSA-3wxw-xv34-2frg, GHSA-8mcc-hrx5-hvxc, GHSA-284h-m62q-gf8w, GHSA-7833-fr7j-v32q,...

AlmaLinux 9 : php:8.2 (ALSA-2026:40416)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:40416 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.2.32 for...

RHEL 7 : postfix (RHSA-2026:57174)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:57174 advisory. The postfix packages provide a Mail Transport Agent MTA, which supports protocols like LDAP, SMTP AUTH SASL, and TLS. Security Fixes: postfix: buffe...

Linux Distros Unpatched Vulnerability : CVE-2026-76014

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATUREWGETTIMEOU...

SUSE SLED15 / SLES15 Security Update : go1.26 (SUSE-SU-2026:3641-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3641-1 advisory. Security issues fixed: - CVE-2026-33818: encoding/asn1: enforce maximum recursion depth bsc1275034. -...

Oracle Linux 10 : curl (ELSA-2026-55450)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55450 advisory. - fix proxy environment variable change detection CVE-2026-8927 - fix HTTP Negotiate connection reuse auth bypass CVE-2026-1965 - fix OAuth2 bearer...

RockyLinux 8 : gstreamer1-plugins-bad-free (RLSA-2026:56521)

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:56521 advisory. gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec IMA/DVI ADPCM decoder CVE-2026-19387 Tenable has extracted the preceding...

MAL-2026-14169 Malicious code in comand (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d3576e830f201f4264c061dc377c51fa35bab19543a98c0feb316305051190b On npm install, scripts/postinstall.js executes automatically. It first POSTs a JSON body containing the resolved host platform Windows/MacOS/Linux,...

Malicious code in comand (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d3576e830f201f4264c061dc377c51fa35bab19543a98c0feb316305051190b On npm install, scripts/postinstall.js executes automatically. It first POSTs a JSON body containing the resolved host platform Windows/MacOS/Linux,...

MAL-2026-14180 Malicious code in lodahs-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15cec128c194761de8cd73923062ece7e4104b5e6130ca40882c5ac9d3f83914 The postinstall lifecycle script in scripts/postinstall.js executes automatically on npm install and performs three attacker-benefiting actions. Firs...

Malicious code in lodahs-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15cec128c194761de8cd73923062ece7e4104b5e6130ca40882c5ac9d3f83914 The postinstall lifecycle script in scripts/postinstall.js executes automatically on npm install and performs three attacker-benefiting actions. Firs...

MAL-2026-14167 Malicious code in chalk-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57cc6705c0b1dabca055a6531e36802822a4441a367459efb4ba8ecbc4a92ce5 chalk-lib is a typosquat of the popular chalk package with an empty library body index.js exports whose entire effect is the postinstall lifecycle...

Malicious code in chalk-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57cc6705c0b1dabca055a6531e36802822a4441a367459efb4ba8ecbc4a92ce5 chalk-lib is a typosquat of the popular chalk package with an empty library body index.js exports whose entire effect is the postinstall lifecycle...

Malicious code in lodash-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ae5d5ee58992e051846753bb190ad3f357538cf5ed570ac825b8b7c9d2a3619 [email protected] typosquats lodash; index.js exports an empty object and the package's only real behavior lives in scripts/postinstall.js. On npm...