Linux Distros Unpatched Vulnerability : CVE-2026-67316

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate...

libntpc1-1.2.5-1.1 on GA media (moderate)

libntpc1-1.2.5-1.1 on GA media Announcement ID: openSUSE-SU-2026:11417-1 Rating: moderate Cross-References: CVE-2026-18321 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the libntpc1-1.2.5-1....

OPENSUSE-SU-2026:11436-1 golang-github-prometheus-prometheus-3.13.2-1.1 on GA media

These are all security issues fixed in the golang-github-prometheus-prometheus-3.13.2-1.1 package on the GA media of openSUSE Tumbleweed...

gio-branding-upstream-2.88.3-1.1 on GA media (moderate)

gio-branding-upstream-2.88.3-1.1 on GA media Announcement ID: openSUSE-SU-2026:11415-1 Rating: moderate Cross-References: CVE-2026-15588 CVSS scores: CVE-2026-15588 SUSE : 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVE-2026-15588 SUSE : 4.8...

Fedora 43 : nextcloud (2026-51116fe081)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-51116fe081 advisory. 34.0.2 Release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

CVE-2026-59884 vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, wazuh-manager, localstack, apache-beam-python-3.12-sdk, dbt-bigquery, wazuh-manager-fips, openstack-keystone-2026.1, openstack-keystone-2025.1, datahub-ingestion, lmcache-cuda-12.8, openstack-keystone-2025.2, authentik, authentik-fips,...

GHSA-M4P7-R5RC-7G4J vulnerabilities

Vulnerabilities for packages: py3-cassandra-medusa, wazuh-manager, localstack, apache-beam-python-3.12-sdk, dbt-bigquery, wazuh-manager-fips, openstack-keystone-2026.1, openstack-keystone-2025.1, datahub-ingestion, lmcache-cuda-12.8, openstack-keystone-2025.2, authentik, authentik-fips,...

CVE-2026-54787 vulnerabilities

Vulnerabilities for packages: falcoctl, goreleaser, kyverno, trivy-operator, trivy, kyverno-notation-aws, zot, policy-controller, skaffold, spire-server, tekton-chains, aactl, flux-source-controller, zarf, neuvector-sigstore-interface, tkn, crossplane, ko, kubescape...

GHSA-WQQC-JJCQ-VFXM vulnerabilities

Vulnerabilities for packages: falcoctl, goreleaser, kyverno, trivy-operator, trivy, kyverno-notation-aws, zot, policy-controller, skaffold, spire-server, tekton-chains, aactl, flux-source-controller, zarf, neuvector-sigstore-interface, tkn, crossplane, ko, kubescape...

GHSA-WG4G-WM44-CH5J vulnerabilities

Vulnerabilities for packages: kubo-fips, ipfs-cluster, rke2-runtime-fips, ipfs-cluster-fips, livekit-egress, spegel-fips, spegel, k3s, telegraf, rke2-runtime, kubo...

CVE-2026-54909 vulnerabilities

Vulnerabilities for packages: kubo-fips, ipfs-cluster, rke2-runtime-fips, stunnerd, ipfs-cluster-fips, livekit-egress, spegel-fips, spegel, k3s, rke2-runtime, kubo...

MAL-2026-11427 Malicious code in pp-react-worldready (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7 package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads...

Malicious code in pp-react-worldready (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7 package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: tar: tar-1.35-9.1.hum1 aarch64, x8664 tar-1.35-9.1.hum1.src src Security Fixes: tar: CVE-2026-18477...

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

UBUNTU-CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

EUVD-2026-51849

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338 JupyterLab before 4.5.9 Stored XSS via Extension Manager

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338

CVE-2026-67338 affects JupyterLab prior to 4.5.9. A stored cross-site scripting vulnerability resides in the Extension Manager where URI protocols in package metadata URLs are not validated. This allows an attacker to publish malicious PyPI packages with javascript: URLs in project metadata, enab...

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...