629026 matches found
CVE-2026-89021: Improper Link Resolution Before File Access
MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files outside the container root by supplying a crafted container image with symlinks pointing to arbitrary paths. Attackers can exploit...
MAL-2026-16202 Malicious code in webpackbootstrapscripts (npm)
[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader index-z2b7r4.js XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a...
[SECURITY] Fedora 44 Update: PackageKit-1.4.0-1.fc44
PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distro, cross-architecture API...
[SECURITY] Fedora 44 Update: golang-x-perf-0-0.36.20260904git19be9d8.fc44
This package holds the source for various tools related to performance measurement, storage, and analysis. - cmd/benchstat contains a command-line tool that computes and 7 compares statistics about benchmarks. - cmd/benchsave contains a command-line tool for publishing benchmark results. - storag...
Malicious code in chroma-client (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0c415e6cd4e653006225dd54672dd79ef076166a2015fa33bbf8f10b789af55 The distribution installs a.pth file that Python auto-executes at interpreter startup on every process using the environment. The.pth file's executab...
CLSA-2026-1789285864 TuxCare security update for org.springframework.data (1 CVE)
TuxCare rebuilt 4 org.springframework.data packages to address 1 CVE. Fixed in 3.3.13-tuxcare.5...
GHSA-GG4H-3HG2-GRPC vulnerabilities
Vulnerabilities for packages: opensearch-dashboards...
[SECURITY] Fedora 45 Update: PackageKit-1.4.0-1.fc45
PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distro, cross-architecture API...
CVE-2026-90651
Socket Firewall socketdev/socket-registry-firewall in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and...
Python Import As an Execution Boundary: An Empirical Study of Bugs, Vulnerabilities, and Analysis Gaps
Python import does more than resolve dependencies: it executes code during module and package initialization. This behavior can trigger failures, load dynamic or native code, access resources, or change security-sensitive state before an application calls a package API. Prior work studies package...
CVE-2026-90651
Socket Firewall socketdev/socket-registry-firewall in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and...
CVE-2026-90651
Socket Firewall socketdev/socket-registry-firewall in registry mode before 2.0.0 does not verify upstream TLS certificates by default. When the apisslverify and upstreamsslverify configuration keys are omitted from socket.yml, the generated configuration sets SOCKETAPISSLVERIFY='false' and...
CLSA-2026-1789220666 TuxCare security update for 40 packages (2 CVEs)
TuxCare rebuilt 40 packages to address 2 CVEs. Fixed in 10.1.42-tuxcare.10...
Malicious code in id79-client (npm)
This package is part of a malicious npm campaign published by the biz44 account. Importing the package automatically launches a detached JavaScript loader that retrieves and executes additional code from npoint.io. The retrieved payload communicates with an attacker-controlled server and implemen...
CLSA-2026-1789219285 TuxCare security update for 123 packages (4 CVEs)
TuxCare rebuilt 123 packages to address 4 CVEs. Fixed in 11.0.32.tuxcare0001...
CVE-2026-84379 vulnerabilities
Vulnerabilities for packages: lmcache-cuda-13.0, py3-httpx2...
CVE-2026-84380 vulnerabilities
Vulnerabilities for packages: lmcache-cuda-13.0, py3-httpx2...
GHSA-PF96-P4FJ-6566 vulnerabilities
Vulnerabilities for packages: lmcache-cuda-13.0, py3-httpx2...