613162 matches found
MAL-2026-11046 Malicious code in intel-cicd-repo-infrastructure (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 26e9f9760ea5108609a4a105c621c9ed1ac03930e70fe4cfe400f7c256a7641a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: rabbitmq-server4.3: rabbitmq-server4.3-4.3.4-0.1.hum1 aarch64, x8664 rabbitmq-server4.3-4.3.4-0.1.hum1.src src...
Malicious code in karpatkey (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b434ae7cf6afb9ce18a54757c03069983e404db695d959bd29aa628864b8349c On import karpatkey, the top-level karpatkey/init.py spawns a daemon background thread that walks the installer's home directory and collects SSH...
MAL-2026-11047 Malicious code in karpatkey (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b434ae7cf6afb9ce18a54757c03069983e404db695d959bd29aa628864b8349c On import karpatkey, the top-level karpatkey/init.py spawns a daemon background thread that walks the installer's home directory and collects SSH...
GHSA-WC96-39FC-566F vulnerabilities
Vulnerabilities for packages: pinot, thingsboard, pinot-fips, apache-hop-fips, seata, hadoop-fips, cassandra-fips, tez, apache-hop, cassandra, management-api-for-apache-cassandra-5.0, tinkerpop...
GHSA-G7HG-VRCF-MVMR vulnerabilities
Vulnerabilities for packages: pinot, thingsboard, pinot-fips, apache-hop-fips, seata, hadoop-fips, cassandra-fips, tez, apache-hop, cassandra, management-api-for-apache-cassandra-5.0, tinkerpop...
GHSA-272M-GCWP-MPWG vulnerabilities
Vulnerabilities for packages: pinot, thingsboard, pinot-fips, apache-hop-fips, seata, hadoop-fips, cassandra-fips, tez, apache-hop, cassandra, management-api-for-apache-cassandra-5.0, tinkerpop...
GHSA-7P3P-8QV8-M2VH vulnerabilities
Vulnerabilities for packages: spark-fips, apache-jena-fuseki, solr, neo4j, apache-tika-fips, cruise-control-fips, jenkins, kafka-fips, solr-fips, strimzi-kafka-operator, kafka, spark-kubernetes-operator, dependency-track, druid, traccar, confluent-kafka-jre-bcfips, reposilite, cruise-control,...
CVE-2026-50289 vulnerabilities
Vulnerabilities for packages: opentelemetry-auto-instrumentations-node, homepage...
GHSA-5XPP-75JX-M839 vulnerabilities
Vulnerabilities for packages: opentelemetry-auto-instrumentations-node, homepage...
GHSA-J3F2-48V5-CCWW vulnerabilities
Vulnerabilities for packages: pulumi, vitess, jitsucom-jitsu, kubeflow-centraldashboard...
CVE-2026-56821 vulnerabilities
Vulnerabilities for packages: cassandra, management-api-for-apache-cassandra-5.0, thingsboard, tez...
CVE-2026-56820 vulnerabilities
Vulnerabilities for packages: cassandra, management-api-for-apache-cassandra-5.0, thingsboard, tez...
GHSA-272M-GCWP-MPWG vulnerabilities
Vulnerabilities for packages: cassandra, management-api-for-apache-cassandra-5.0, thingsboard, tez...
GHSA-WC96-39FC-566F vulnerabilities
Vulnerabilities for packages: cassandra, management-api-for-apache-cassandra-5.0, thingsboard, tez...
GHSA-G7HG-VRCF-MVMR vulnerabilities
Vulnerabilities for packages: cassandra, management-api-for-apache-cassandra-5.0, thingsboard, tez...
CVE-2026-56822 vulnerabilities
Vulnerabilities for packages: cassandra, management-api-for-apache-cassandra-5.0, thingsboard, tez...
CVE-2026-63317 Apache OpenNLP: Arbitrary Class Instantiation in GeneratorFactory via Feature Descriptor XML
Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.forName and invoke its no-arg constructor...
Malicious code in subapp-pkg-util (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae51b43e9a5110ec02eb9aa1cbf03837b2a560f4b6c8168b1c2d675802a113ae package.json declares a postinstall hook that runs index.js on npm install. index.js collects host identifiers os.hostname, os.userInfo, os.platform,...
Malicious code in @daylightqc/date-fmt-lite (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62c563208137dbdd6b4c26764222942e2b81e815349b596518ff4db5a652b2bf The package declares a postinstall script postinstall.js that runs automatically on npm/pnpm install and POSTs host identifiers hostname, whoami, pwd...