Malicious code in mw-filesystem-events-nodream (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3da27e815b33bf88dc4fb31bc8b5558501b65ded9de77aab08e7ae785c2c38b The package mw-filesystem-events-nodream was found to contain malicious code. Source: ossf-package-analysis...

OPENSUSE-SU-2026:10741-1 go1.26-1.26.3-1.1 on GA media

These are all security issues fixed in the go1.26-1.26.3-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-63706

NPM package next-npm-version1.0.1 is vulnerable to Command injection...

CVE-2025-63706

NPM package next-npm-version1.0.1 is vulnerable to Command injection...

@netlify/agent-runner-cli (>=1.83.1, <=1.94.0), feishu-claude-bot (0.1.0) +1 more potentially affected by CVE-2026-40068 via @anthropic-ai/claude-code (>=2.1.63, <=2.1.81)

@anthropic-ai/claude-code NPM version =2.1.63, =1.83.1, =1.2.2, =1.2.3 Source cves: CVE-2026-40068 Source advisory: SNYK:JS-ANTHROPICAICLAUDECODE-16301567...

OPENSUSE-SU-2026:10599-1 cacti-1.2.30+git306.82d5aef5-1.1 on GA media

These are all security issues fixed in the cacti-1.2.30+git306.82d5aef5-1.1 package on the GA media of openSUSE Tumbleweed...

1router (>=0.3.96, <=1.0.2), 3d-bin-packing-ts (>=1.0.0, <=1.0.1) +7586 more potentially affected by CVE-2026-41907 via uuid (>=12.0.0, <=13.0.2)

uuid NPM version =12.0.0, =0.3.96, =1.0.0, =2.1.0, =0.3.33, =0.3.0, =0.5.0, =0.4.71, =0.0.1, =0.3.0, =0.4.0, =0.2.0, =0.2.1 - @0xcurvy/curvy-mcp 0.1.0 and more Source cves: CVE-2026-41907 Source advisory: SNYK:JS-UUID-16133035...

@cmmn/tools (>=3.0.0-alpha-1, <=3.0.0-alpha-6), mikr0 (0.1.10) potentially affected by CVE-2026-33808 via @fastify/express (>=4.0.1, <=4.0.2)

@fastify/express NPM version =4.0.1, =3.0.0-alpha-1, =3.0.0-alpha-6 - mikr0 0.1.10 Source cves: CVE-2026-33808 Source advisory: OSV:GHSA-6HW5-45GM-FJ88...

OPENSUSE-SU-2026:10562-1 flannel-0.28.4-1.1 on GA media

These are all security issues fixed in the flannel-0.28.4-1.1 package on the GA media of openSUSE Tumbleweed...

Defense in Depth update for NuGet Client

Impact This update adds validation of the package ID and version during package download, in addition to the existing package signature validation. Patches NuGet The following NuGet.exe, NuGet.CommandLine, NuGet.Packaging, and NuGet.Protocol versions have been patched: |Affected versions|Patched...

@frontmcp/adapters (>=0.5.0, <=1.0.3), frontmcp (0.5.0) potentially affected by CVE-2026-39885 via mcp-from-openapi (>=2.0.0, <=2.1.2)

mcp-from-openapi NPM version =2.0.0, =0.5.0, =1.0.3 - frontmcp 0.5.0 Source cves: CVE-2026-39885 Source advisory: OSV:GHSA-V6PH-XCQ9-QXXJ...

@ascua/electron (0.7.0), @lvce-editor/main-process (>=2.23.0, <=3.1.0) +27 more potentially affected by CVE-2026-34769 via electron (>=39.0.0, <=39.2.7)

electron NPM version =39.0.0, =2.23.0, =3.1.0 - @obsidian-typings/obsidian-catalyst-1.11.0 4.73.0 - @obsidian-typings/obsidian-catalyst-1.11.1 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.2 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11.3 4.88.0 - @obsidian-typings/obsidian-catalyst-1.11....

MAL-2026-2443 Malicious code in exprrrress (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3605883655f4870250aaab1c630151c6264e54521d1a711a088871de1fe5ea5 The package exprrrress was found to contain malicious code. Source: ossf-package-analysis...

OPENSUSE-SU-2026:10461-1 python311-nltk-3.9.4-1.1 on GA media

These are all security issues fixed in the python311-nltk-3.9.4-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:10438-1 openbao-2.5.2-1.1 on GA media

These are all security issues fixed in the openbao-2.5.2-1.1 package on the GA media of openSUSE Tumbleweed...

Medium: amazon-cloudwatch-agent

Issue Overview: net/http: memory exhaustion in Request.ParseForm CVE-2025-61726 archive/zip: denial of service when parsing arbitrary ZIP archives CVE-2025-61728 crypto/tls: handshake messages may be processed at the incorrect encryption level CVE-2025-61730 crypto/tls: Config.Clone copies...

OPENSUSE-SU-2026:10379-1 python311-CairoSVG-2.9.0-1.1 on GA media

These are all security issues fixed in the python311-CairoSVG-2.9.0-1.1 package on the GA media of openSUSE Tumbleweed...

@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +127 more potentially affected by CVE-2026-30952 via liquidjs (>=10.2.0, <=10.24.0)

liquidjs NPM version =10.2.0, =0.0.4, =0.6.0, =0.1.0, =0.0.0, =12.0.0, =1.0.1-beta.0, =1.6.3, =3.11.0-rc.0, =3.11.0-rc.0, =3.11.0-rc.0, =0.9.33, =1.0.0, =1.0.10 and more Source cves: CVE-2026-30952 Source advisory: OSV:GHSA-WMFP-5Q7X-987X...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the tenant management handlers in the /api/v1/tenants routes. An attacker can read, modify, or delete any tenant, including transferring ownership or destroying tenants, by calling GET, PUT, or DELETE on...

AZL-79472 CVE-2026-3381 affecting package rust 1.75.0-25

Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib. Compress::Raw::Zlib includes a copy of the zlib library. Compress::Raw::Zlib version 2.220 includes zlib 1.3.2, which addresses findings fron the 7ASecurity audit of zlib. The includes fixs for...