612413 matches found
gio-branding-upstream-2.88.3-1.1 on GA media (moderate)
gio-branding-upstream-2.88.3-1.1 on GA media Announcement ID: openSUSE-SU-2026:11415-1 Rating: moderate Cross-References: CVE-2026-15588 CVSS scores: CVE-2026-15588 SUSE : 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVE-2026-15588 SUSE : 4.8...
OPENSUSE-SU-2026:11436-1 golang-github-prometheus-prometheus-3.13.2-1.1 on GA media
These are all security issues fixed in the golang-github-prometheus-prometheus-3.13.2-1.1 package on the GA media of openSUSE Tumbleweed...
CVE-2026-59884 vulnerabilities
Vulnerabilities for packages: localstack, py3-cassandra-medusa, kubeflow-pipelines, apache-beam-python-3.12-sdk, airflow, datahub-ingestion, mlflow, superset, openstack-keystone-2025.1, dbt-bigquery, openstack-keystone-2026.1, authentik-fips, wazuh-manager, openstack-keystone-2025.2, authentik,...
GHSA-M4P7-R5RC-7G4J vulnerabilities
Vulnerabilities for packages: localstack, py3-cassandra-medusa, kubeflow-pipelines, apache-beam-python-3.12-sdk, airflow, datahub-ingestion, mlflow, superset, openstack-keystone-2025.1, dbt-bigquery, openstack-keystone-2026.1, authentik-fips, wazuh-manager, openstack-keystone-2025.2, authentik,...
CVE-2026-54787 vulnerabilities
Vulnerabilities for packages: skaffold, goreleaser, tekton-chains, falcoctl, aactl, neuvector-sigstore-interface, tkn, trivy, ko, policy-controller, trivy-operator, kyverno, kyverno-notation-aws, kubescape, zot, zarf, crossplane, spire-server, flux-source-controller...
GHSA-WQQC-JJCQ-VFXM vulnerabilities
Vulnerabilities for packages: skaffold, goreleaser, tekton-chains, falcoctl, aactl, neuvector-sigstore-interface, tkn, trivy, ko, policy-controller, trivy-operator, kyverno, kyverno-notation-aws, kubescape, zot, zarf, crossplane, spire-server, flux-source-controller...
GHSA-WG4G-WM44-CH5J vulnerabilities
Vulnerabilities for packages: rke2-runtime-fips, ipfs-cluster-fips, spegel, ipfs-cluster, livekit-egress, kubo-fips, rke2-runtime, kubo, telegraf, k3s, spegel-fips...
CVE-2026-54909 vulnerabilities
Vulnerabilities for packages: rke2-runtime-fips, ipfs-cluster-fips, spegel, ipfs-cluster, livekit-egress, stunnerd, kubo-fips, rke2-runtime, kubo, k3s, spegel-fips...
MAL-2026-11427 Malicious code in pp-react-worldready (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7 package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads...
Malicious code in pp-react-worldready (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7 package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: tar: tar-1.35-9.1.hum1 aarch64, x8664 tar-1.35-9.1.hum1.src src Security Fixes: tar: CVE-2026-18477...
CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
UBUNTU-CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
EUVD-2026-51849
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
CVE-2026-67338 JupyterLab before 4.5.9 Stored XSS via Extension Manager
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
CVE-2026-67338
CVE-2026-67338 affects JupyterLab prior to 4.5.9. A stored cross-site scripting vulnerability resides in the Extension Manager where URI protocols in package metadata URLs are not validated. This allows an attacker to publish malicious PyPI packages with javascript: URLs in project metadata, enab...
bitcoin-nostr-relay (0.1.1), kormir (>=0.1.0, <=1.0.11) +5 more potentially affected by unknown CVE via nostr (>=0.1.5, <=0.40.0)
nostr CARGO version =0.1.5, =0.1.0, =0.2.6, =0.0.1, =0.1.6, =0.19.0, =0.21.0 - nostr-web 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0229...
MAL-2026-11425 Malicious code in nvtorch-oot-nightly (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92503f2178663997d57ffa45fbb89f4a55de70e94f66745b4edf283a98e830f The package's setup.py issues an install-time HTTP request to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/nvtorchootnightly...
Malicious code in nvtorch-oot-nightly (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92503f2178663997d57ffa45fbb89f4a55de70e94f66745b4edf283a98e830f The package's setup.py issues an install-time HTTP request to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/nvtorchootnightly...