PT-2026-57833

These are all security issues fixed in the python313-Pillow-12.3.0-1.1 package on the GA media of openSUSE Tumbleweed...

Malicious code in awesome-ts-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dc9fa6bfe010d792303258bd713e854e8c218c18762d62b864e8a350d1b473e Package advertises itself as a TypeScript/ESLint/Jest toolkit but ships no such tooling. On import, index.js - run - packProjectBundle walks the...

MAL-2026-10190 Malicious code in tinyparrot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7ebbcc82edaa241764193ea85c0492b99f9ed3be805c57ef0914518cd4b6f9 The postinstall script src/build.js reconstructs the strings 'https', 'POST', and the destination host 'rnjkerbf.org/P' from integer-encoded arrays v...

Malicious code in tinyparrot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ec7ebbcc82edaa241764193ea85c0492b99f9ed3be805c57ef0914518cd4b6f9 The postinstall script src/build.js reconstructs the strings 'https', 'POST', and the destination host 'rnjkerbf.org/P' from integer-encoded arrays v...

MAL-2026-10186 Malicious code in google-caja-bower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e34339f1be6afb8a41b6dbe2f7d7c480d5a438a67ff119b235d1d98ffa2b2e4a [email protected] declares scripts.preinstall = 'node index.js', so index.js runs automatically on npm install. index.js walks the...

MGASA-2026-0241 Updated libarchive packages fix security vulnerabilities

The updated packages fix bugs including security ones...

CVE-2026-58011 affecting package glib for versions less than 2.78.6-10

CVE-2026-58011 affecting package glib for versions less than 2.78.6-10. A patched version of the package is available...

CVE-2026-39822 affecting package golang for versions less than 1.25.12-1

CVE-2026-39822 affecting package golang for versions less than 1.25.12-1. A patched version of the package is available...

CVE-2026-58010 affecting package glib for versions less than 2.78.6-10

CVE-2026-58010 affecting package glib for versions less than 2.78.6-10. A patched version of the package is available...

tamilai (0.0.2) potentially affected by CVE-2026-61426 via praisonai (1.7.1)

praisonai NPM version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on praisonai and may be impacted: - tamilai 0.0.2 Source cves: CVE-2026-61426 Source advisory: SNYK:JS-PRAISONAI-17950764...

Unchecked Return Value

Overview Magick.NET-Q16-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

@openinc/parse-server-opendash (>=4.0.0, <=4.1.2) potentially affected by CVE-2026-61448 via parse-server (>=9.6.0-alpha.37, <=9.9.1-alpha.13)

parse-server NPM version =9.6.0-alpha.37, =4.0.0, =4.1.2 Source cves: CVE-2026-61448 Source advisory: SNYK:JS-PARSESERVER-17950968...

Unchecked Return Value

Overview Magick.NET-Q16-HDRI-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

RHSA-2026:38090 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

RHSA-2026:38017 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Bulletin has no description...

GHSA-FXHP-MV3V-67QP vulnerabilities

Vulnerabilities for packages: drone, zarf-fips, rancher-fleet, teleport, trivy-operator-fips, argocd-image-updater, kots, linkerd2, oras-fips, kyverno, trivy-operator, chartmuseum-fips, kgateway, kgateway-fips, grafana-operator, argo-cd-fips, consul-k8s-fips, rancher-agent, vcluster-fips,...

GHSA-FXHP-MV3V-67QP vulnerabilities

Vulnerabilities for packages: rancher-fleet, kots, oras, conftest, argo-cd, helm-operator, rancher, vcluster, tigera-operator, flux-source-controller, ratify, zot, argocd-image-updater, kyverno, consul-k8s, k8ssandra-client, gogatekeeper, trivy-operator, headlamp, gatekeeper, kubescape-operator,...

CVE-2026-15335

The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter form in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

EUVD-2026-43143

The Booking Package plugin for WordPress is vulnerable to generic SQL Injection via 'email' Form Parameter form in all versions up to, and including, 1.7.20 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2026-15335

The Booking Package WordPress plugin is vulnerable up to version 1.7.20 due to insufficient escaping on the email parameter in the REST endpoint /wp-json/booking-package/v1/request, allowing unauthenticated SQL injection. Root cause: user-supplied email input reaches the SQL sink without proper e...