Malicious code in requestor-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8a60f357ab63e9818e450e4e4aec3dcf1b08d1242931ad5ad8468a460ee82ba [email protected] is a hollow wrapper empty index.js, placeholder 99.9.1 version whose only effect on install is to resolve a dependency declared...

MAL-2026-10940 Malicious code in chai-leaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77cc7562a27df348fafc455124fd845dfc2e5774c42279ee6e3dd8f1cfb1f05b [email protected]'s main entry index.js unconditionally requires./lib/config, which is a single 3,546,568-byte obfuscator.io-encoded file 20,721-entry...

Malicious code in chai-leaf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77cc7562a27df348fafc455124fd845dfc2e5774c42279ee6e3dd8f1cfb1f05b [email protected]'s main entry index.js unconditionally requires./lib/config, which is a single 3,546,568-byte obfuscator.io-encoded file 20,721-entry...

MAL-2026-10939 Malicious code in chai-as-reddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eff17b9d2536e662413c5c7090a1611f8c2813033a03960f9d979f23f2f72e7 The npm package [email protected] is a trojaned distribution. Its published metadata and README describe a Chai plugin for Reddit API assertions,...

Malicious code in chai-as-reddit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8eff17b9d2536e662413c5c7090a1611f8c2813033a03960f9d979f23f2f72e7 The npm package [email protected] is a trojaned distribution. Its published metadata and README describe a Chai plugin for Reddit API assertions,...

PT-2026-63276

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.27.0 Description An authenticated user can cause a denial of service by sending a large HTTP request to the NPM package tag API endpoint. The AddPackageTag function reads the entire request body into memory using...

PT-2026-63314

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authenticated user with package publishing permissions can cause resource amplification by uploading a specially crafted Arch package archive. The system records non-dot regular file entries...

golang security update

1.26.5-1.0.1 - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var 1.26.5-1 - Update to Go 1.26.5 fips-1 1.25.7-1 - Update to Go 1.25.7 fips-1 1.25.5-1 - Update to Go 1.25.5 fips-1 1.25.3-5 - gating.yaml: Add tier1 s390x tests 1.25.3-4 - Cleanup lib/ ownership - Remove legacy logic forcing lib/...

Malicious code in faust-cont (npm)

The npm package faust-cont is a supply-chain dropper disguised as a benign CLI tool index.js is a decoy that only logs "cli tool install package loaded". The real behaviour is placed in an install script. An install lifecycle hook install: node install.js executes automatically on npm install,...

acl-2.4.0-1.1 on GA media (moderate)

acl-2.4.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11312-1 Rating: moderate Cross-References: CVE-2026-54369 CVE-2026-54370 CVE-2026-54371 CVSS scores: CVE-2026-54369 SUSE : 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVE-2026-54369 SUSE : 8.8...

MAL-2026-10990 Malicious code in ts-vitest (npm)

ts-vitest is a typosquat of vitest/ts-eslint hollow "kelly-calc"/"clob-math" content, no legitimate functionality that ships a postinstall two-stage fetch-exec dropper. The package.json declares postinstall: node scripts/install-check.cjs; the hook's resolvePeerBundleUrl fetches a JSON config fro...

PT-2026-63286

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The Debian package registry parser contains two issues that can lead to a complete denial of service. First, an unbounded decompression flaw exists in the ParseControlFile function. When...

MAL-2026-11001 Malicious code in date-format-utils-xz (npm)

The npm package date-format-utils-xz masquerades as a date-formatting utility but is malicious. Its own decoy index.js is prefaced with a Chinese comment translating to "disguised as a normal date formatting tool." Every published version 1.0.0-1.0.4 declares a postinstall lifecycle hook...

PT-2026-63282

Name of the Vulnerable Software and Affected Versions Gitea version 1.26.2 Description A bypass exists for the public-only Personal Access Token PAT scope when the owner's visibility is set to Limited instance-internal. While other scope categories correctly reject Limited owners, the Repository...

OPENSUSE-SU-2026:11323-1 python313-bleach-6.4.0-1.1 on GA media

These are all security issues fixed in the python313-bleach-6.4.0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11321-1 perl-YAML-1.320.0-1.1 on GA media

These are all security issues fixed in the perl-YAML-1.320.0-1.1 package on the GA media of openSUSE Tumbleweed...

Oracle Linux 9 : plexus-utils (ELSA-2026-38796)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-38796 advisory. 3.3.0-14 - Fix CVE-2025-67030: Directory Traversal in Expand.extractFile Resolves: RHEL-165350 Tenable has extracted the preceding description block directly...

Oracle Linux 9 : acl (ELSA-2026-42736)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42736 advisory. 2.4.0-1 - rebase to 2.4.0 to fix the following CVEs: - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions RHEL-186111 -...

Fedora 44 : nuclei (2026-3a8abe43fb)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3a8abe43fb advisory. Update to 3.11.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Oracle Linux 10 : git-lfs (ELSA-2026-39272)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-39272 advisory. - Fix CVE-2026-39821 in vendored golang.org/x/net idna package Tenable has extracted the preceding description block directly from the Oracle Linux security...