[SECURITY] Fedora 45 Update: bluez-5.87+1.git8750129efca8-1.fc45

Utilities for use in Bluetooth applications: - avinfo - bluemoon - bluetoothctl - bluetoothd - btattach - btmon - hex2hcd - mpris-proxy The BLUETOOTH trademarks are owned by Bluetooth SIG, Inc., U.S.A...

PT-2026-90937

These are all security issues fixed in the syncthing-2.1.5-1.1 package on the GA media of openSUSE Tumbleweed...

Fedora 43 : srt (2026-dfc8680f21)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-dfc8680f21 advisory. Update to 1.5.7 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

PT-2026-90933

These are all security issues fixed in the coreutils-9.11-5.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-90932

These are all security issues fixed in the ant-1.10.18-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-90935

These are all security issues fixed in the hauler-2.1.0-4.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-90934

These are all security issues fixed in the docker-29.7.2 ce-41.1 package on the GA media of openSUSE Tumbleweed...

CVE-2026-81011

A flaw was found in the Linux kernel's hp-bioscfg module. The module's package parsers incorrectly determine the number of elements in a package, using a value derived from a name string rather than the true package size. While currently prevented by existing validation, a future change to the...

CVE-2026-66485 affecting package cpio for versions less than 2.14-2

CVE-2026-66485 affecting package cpio for versions less than 2.14-2. A patched version of the package is available...

CVE-2026-75900 affecting package swtpm for versions less than 0.8.1-6

CVE-2026-75900 affecting package swtpm for versions less than 0.8.1-6. A patched version of the package is available...

CVE-2025-4432 affecting package trident for versions less than 0.28.0-1

CVE-2025-4432 affecting package trident for versions less than 0.28.0-1. A patched version of the package is available...

CVE-2026-9804 affecting package kubevirt for versions less than 1.8.4-1

CVE-2026-9804 affecting package kubevirt for versions less than 1.8.4-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-54522 affecting package rubygem-msgpack for versions less than 1.8.4-1

CVE-2026-54522 affecting package rubygem-msgpack for versions less than 1.8.4-1. An upgraded version of the package is available that resolves this issue...

Malicious code in platform-telemetry-client (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7464733f1d7353ae3aa3c9da2c60116c92298bfd84c94a6cba4e5f423cb0a0eb The package contains PTH file triggering the loader on every Python initialization. The loader tries to download next stage payload stored in chunks in DNS...

Malicious code in tracker-cloudflare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, cwd along with the...

MAL-2026-16140 Malicious code in tracker-cloudflare (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55b5bacf5779f1a1fa161ee38acbf61fda0dc18b3d0fe35213e2b0dc230c06e4 The package's preinstall hook runs node index.js, which collects host identifiers os.hostname, os.userInfo, homedir, DNS servers, cwd along with the...

CLSA-2026-1789166016 TuxCare security update for org.springframework (6 CVEs)

TuxCare rebuilt 24 org.springframework packages to address 6 CVEs. Fixed in 5.3.7-tuxcare.9...

NPM: FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix

NPM: FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix vulnerability discovered by ? in WordPress Npm mcp-from-openapi versions = 2.3.0, 2.5.0...

CVE-2026-54174

melange allows users to build apk packages using declarative pipelines. Apko prior to version 1.2.9, corresponding to melange prior to version 0.50.4, verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files tha...

CVE-2026-54174

CVE-2026-54174 affects melange (Chainguard's declarative APK package builder), specifically the Apko component (chainguard.dev/apko). Prior to Apko 1.2.9 (corresponding to melange 0.50.4), the tool verified the control section hash (.PKGINFO etc.) against the signed APKINDEX but never verified th...