TencentOS Server 3: tigervnc (TSSA-2026:0629)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0629 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

MAL-2026-10941 Malicious code in aftermath-finance (npm)

The aftermath-finance package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package...

Malicious code in org-twilio-phone-numbers-utils (npm)

The org-twilio-phone-numbers-utils package is a dependency-confusion squat of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected] at sentinel versions 99.99.99 and 99.99.100, chosen to outrank any internal/private version and win resolution against a...

Malicious code in markscan (npm)

The markscan package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so that...

Malicious code in zer0onetencent (npm)

The zer0onetencent package was published to the npm registry by user 't2423048543' maintainer email [email protected]. It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello stub returning the package name, indicating a package...

Malicious code in twilio-serverless (npm)

The twilio-serverless package is one of four byte-identical dependency-confusion squats of Twilio's npm namespace published by user 'yuva2210' maintainer email [email protected], all at the sentinel version 99.99.99 chosen to outrank any internal/private version and win resolution agains...

PT-2026-62019

These are all security issues fixed in the libsoup-3 0-0-3.6.6-7.1 package on the GA media of openSUSE Tumbleweed...

Malicious code in aftermath-sui (npm)

The aftermath-sui package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...

Malicious code in aftermathfi (npm)

The aftermathfi package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package was...

MAL-2026-10949 Malicious code in @iphouse/api (npm)

The @iphouse/api package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

MAL-2026-10952 Malicious code in @markscan/core (npm)

The @markscan/core package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms s...

MAL-2026-10958 Malicious code in iphouse-api (npm)

The iphouse-api package was published to the npm registry by user 'jonothhu' maintainer email [email protected] as one of 19 packages in a dependency-confusion campaign targeting the 'markscan', 'akrai', and 'iphouse' namespaces, published in both unscoped and scoped @scope/name forms so...

Critical Photon OS Security Update - PHSA-2026-5.0-0926

Updates of 'openssh', 'linux-esx', 'linux' packages of Photon OS have been released...

Linux Distros Unpatched Vulnerability : CVE-2026-64184

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: call missing memcgroupiterbreak damonsysfsmemcgpathtoid breaks...

TencentOS Server 3: grafana-pcp (TSSA-2026:0635)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0635 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

Linux Distros Unpatched Vulnerability : CVE-2026-45799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup and...

Linux Distros Unpatched Vulnerability : CVE-2026-64035

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igcfpeinitsmdframe initializ...

RHEL 8 : rhc (RHSA-2026:41930)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:41930 advisory. rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management. Security...

Linux Distros Unpatched Vulnerability : CVE-2026-63932

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: iio: chemical: mhz19b: reject oversized serial replies mhz19breceivebuf appends each serdev...

Fedora 44 : wget1 (2026-1b91a2f126)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-1b91a2f126 advisory. Fix for CVE-2026-15146, CVE-2026-58470, CVE-2026-58471, CVE-2026-58472 Tenable has extracted the preceding description block directly from the Fedor...