628997 matches found
ROOT-APP-NPM-CVE-2026-63376 CVE-2026-63376 in toml - Patched by Root
Root has patched CVE-2026-63376 in the toml package for Root:npm. Multiple fixed versions available...
CLSA-2026-1789379074 TuxCare security update for io.netty (22 CVEs)
TuxCare rebuilt 46 io.netty packages to address 22 CVEs. Fixed in 4.1.79.Final-tuxcare.4...
CLSA-2026-1789377089 TuxCare security update for org.springframework (4 CVEs)
TuxCare rebuilt 23 org.springframework packages to address 4 CVEs. Fixed in 5.2.0.RELEASE-tuxcare.5...
ROOT-APP-NPM-CVE-2026-42040 CVE-2026-42040 in axios - Patched by Root
Root has patched CVE-2026-42040 in the axios package for Root:npm. Multiple fixed versions available...
CLSA-2026-1789376303 TuxCare security update for 4 packages (1 CVE)
TuxCare rebuilt 4 packages to address 1 CVE. Fixed in 3.2.11-tuxcare.5...
CLSA-2026-1789369685 TuxCare security update for org.springframework.graphql (1 CVE)
TuxCare rebuilt 2 org.springframework.graphql packages to address 1 CVE. Fixed in 1.2.9-tuxcare.6...
CLSA-2026-1789368896 TuxCare security update for 2 packages (1 CVE)
TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 2.22.4.post9+tuxcare...
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...
golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...
[SECURITY] Fedora 45 Update: rust-hickory-net-0.26.2-1.fc45
Hickory-net is a safe and secure low-level DNS library. This is the foundational DNS protocol library used by the other higher-level Hickory DNS crates...
Malicious code in webpackbootstrapscripts (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
Malicious code in faiss-cpu-avx512 (PyPI)
[email protected] through 1.9.7 on PyPI impersonates faiss-cpu and ships no FAISS code: faisscpuavx512/init.py fetchnative downloads an xz-compressed binary from https://files.catbox.moe/ ffoa50.xz in 1.9.0 to 1.9.3, 0oreqo.xz in 1.9.4, vwfr94.xz in 1.9.5, 3l3x0v.xz in 1.9.6, weu5u2.xz in...
Medium: composer
Issue Overview: Package bin path can escape the package directory, bypassing the GHSA-gjfg-22fp-rrxx fix. A malicious or compromised Composer package could, when installed as a dependency, cause Composer to change the permissions of a file outside that package's own directory and to register a...
Malicious code in webpackbootstrap5 (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
CVE-2026-89021: Improper Link Resolution Before File Access
MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit...
MAL-2026-16202 Malicious code in webpackbootstrapscripts (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
[SECURITY] Fedora 44 Update: PackageKit-1.4.0-1.fc44
PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distro, cross-architecture API...
[SECURITY] Fedora 44 Update: golang-x-perf-0-0.36.20260904git19be9d8.fc44
This package holds the source for various tools related to performance measurement, storage, and analysis. - cmd/benchstat contains a command-line tool that computes and 7 compares statistics about benchmarks. - cmd/benchsave contains a command-line tool for publishing benchmark results. - storag...
Malicious code in chroma-client (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0c415e6cd4e653006225dd54672dd79ef076166a2015fa33bbf8f10b789af55 The distribution installs a.pth file that Python auto-executes at interpreter startup on every process using the environment. The.pth file's executab...