NPM: re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)

NPM: re2: Global String.prototype.match with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth DoS vulnerability discovered by ? in WordPress Npm re2 versions = 1.25.1...

ROOT-APP-NPM-CVE-2026-59877 CVE-2026-59877 in @rootio/protobufjs - Patched by Root

Root has patched CVE-2026-59877 in the @rootio/protobufjs package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-45740 CVE-2026-45740 in @rootio/protobufjs - Patched by Root

Root has patched CVE-2026-45740 in the @rootio/protobufjs package for Root:npm. Multiple fixed versions available...

RHSA-2026:48758 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

CVE-2026-18157

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

CVE-2026-18157

CVE-2026-18157 concerns the yggdrasil-worker-package-manager. A local attacker with existing system access can exploit an argument injection vulnerability in the APT backend, where specially crafted package names beginning with a hyphen are misinterpreted as apt-get options. Successful exploitati...

CVE-2026-18157 Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

EUVD-2026-51380

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

CVE-2026-18157 Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection

A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-ge...

ROOT-APP-NPM-CVE-2026-49458 CVE-2026-49458 in @rootio/dompurify - Patched by Root

Root has patched CVE-2026-49458 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-6734 CVE-2026-6734 in @rootio/undici - Patched by Root

Root has patched CVE-2026-6734 in the @rootio/undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-9679 CVE-2026-9679 in @rootio/undici - Patched by Root

Root has patched CVE-2026-9679 in the @rootio/undici package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-QRV3-253H-G69C GHSA-qrv3-253h-g69c in @rootio/pnpm - Patched by Root

Root has patched GHSA-qrv3-253h-g69c in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-53655 CVE-2026-53655 in @rootio/tar - Patched by Root

Root has patched CVE-2026-53655 in the @rootio/tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-29786 CVE-2026-29786 in @rootio/tar - Patched by Root

Root has patched CVE-2026-29786 in the @rootio/tar package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-23745 CVE-2026-23745 in @rootio/tar - Patched by Root

Root has patched CVE-2026-23745 in the @rootio/tar package for Root:npm. Multiple fixed versions available...

CLEANSTART-2026-CB11602 Security fixes in npm 11.18.0-r0

Package npm version 11.18.0-r0 fixes 1 vulnerabilities: CVE-2026-13149...

CLEANSTART-2026-TH02378 Security fixes in npm 11.14.0-r4

Package npm version 11.14.0-r4 fixes 8 vulnerabilities: ghsa-vxpw-j846-p89q, ghsa-p88m-4jfj-68fv, ghsa-g8m3-5g58-fq7m, ghsa-35p6-xmwp-9g52, CVE-2026-12151...

Amazon Links Debug and Chalk npm Hijack to North Korea’s Sapphire Sleet

Amazon has tied the September 2025 hijack of the npm packages debug and chalk to North Korea. For ten months, the incident sat in the public record as crypto theft: a maintainer phished through a lookalike npm domain and a wallet-draining script pushed into at least 18 packages carrying more than...

JetBrains WebStorm < 2026.2 Multiple Vulnerabilities

The version of JetBrains WebStorm installed on the remote host is prior to 2026.2. It is, therefore, affected by multiple vulnerabilities: - Arbitrary code execution was possible before granting project trust via project-local linter tooling. CVE-2026-64804 - Arbitrary code execution was possible...