ROOT-APP-NPM-CVE-2026-49458 CVE-2026-49458 in dompurify - Patched by Root

Root has patched CVE-2026-49458 in the dompurify package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-54288 CVE-2026-54288 in hono - Patched by Root

Root has patched CVE-2026-54288 in the hono package for Root:npm. Multiple fixed versions available...

The vulnerability of the package manager for Kubernetes Helm, related to unvalidated array indexing, allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the package manager for Kubernetes Helm is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Important: Red Hat Security Advisory: yggdrasil-worker-package-manager security update

An update for yggdrasil-worker-package-manager is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

RHEL 10 : yggdrasil-worker-package-manager (RHSA-2026:71420)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:71420 advisory. yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable...

RLSA-2026:69099 Important: yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that matc...

yggdrasil-worker-package-manager security update

An update is available for yggdrasil-worker-package-manager. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list yggdrasil-worker-package-manager is a simple packag...

CVE-2026-25255 Exposed function in Qualcomm Package Manager and Qualcomm Software Center.

Exposed dangerous function lead to privilege escalation via gRPC server...

CVE-2026-25255 Exposed function in Qualcomm Package Manager and Qualcomm Software Center.

Exposed dangerous function lead to privilege escalation via gRPC server...

ROOT-APP-NPM-AIKIDO-2026-10844 AIKIDO-2026-10844 in vm2 - Patched by Root

Root has patched AIKIDO-2026-10844 in the vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-10841 AIKIDO-2026-10841 in vm2 - Patched by Root

Root has patched AIKIDO-2026-10841 in the vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-AIKIDO-2026-10689 AIKIDO-2026-10689 in vm2 - Patched by Root

Root has patched AIKIDO-2026-10689 in the vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2022-23529 CVE-2022-23529 in jsonwebtoken - Patched by Root

Root has patched CVE-2022-23529 in the jsonwebtoken package for Root:npm. Multiple fixed versions available...

AlmaLinux 10 : yggdrasil-worker-package-manager (ALSA-2026:69099)

The remote AlmaLinux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:69099 advisory. net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 encoding/xml: golang: Go: Denial of Servi...

RockyLinux 10 : yggdrasil-worker-package-manager (RLSA-2026:69099)

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69099 advisory. net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution CVE-2026-56860 encoding/xml: golang: Go: Denial of...

The vulnerability of the new VM component in the vm2 library of the NPM package manager allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the new VM component in the vm2 library of the NPM package manager is related to a breach of data protection mechanisms. Exploiting this vulnerability allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Important: Red Hat Security Advisory: yggdrasil-worker-package-manager security update

An update for yggdrasil-worker-package-manager is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

CVE-2026-54584: External Control of File Name or Path

mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to a...

PT-2026-96107

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager improperly handles the TMPDIR environment variable when extracting package metafiles, even when operating as root or within setuid/setgid contexts. An attacker who can...

ALSA-2026:69099 Important: yggdrasil-worker-package-manager security update

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that matc...