629291 matches found
MAL-2026-16048 Malicious code in punypump (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e56cc14096d20f679823bf15af9f44dff039e01f23d2082eba8020200d04a7f The package presents itself as a console shim index.js is a verbatim copy of console-browserify with description 'Emulate console for all the...
CLSA-2026-1788892753 TuxCare security update for 3 packages (1 CVE)
TuxCare rebuilt 3 packages to address 1 CVE. Fixed in 0.26.1-tuxcare.3...
net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...
NPM: LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process
NPM: LiquidJS: Uncontrolled Resource Consumption in join filter allows template authors to bypass memoryLimit and crash the process vulnerability discovered by ? in WordPress Npm liquidjs versions = 10.27.1...
Malicious code in @usemosaik/template-react-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3174ac7cecbc1869ae5ac87ea585de744f6b7d17b8c089b746384c2b7e2355a3 This template package ships files/vite.config.js which, after a benign Vite header, appends 26KB of heavily obfuscated code obfuscator.io-style...
MAL-2026-16047 Malicious code in @usemosaik/template-react-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3174ac7cecbc1869ae5ac87ea585de744f6b7d17b8c089b746384c2b7e2355a3 This template package ships files/vite.config.js which, after a benign Vite header, appends 26KB of heavily obfuscated code obfuscator.io-style...
ROOT-APP-NPM-CVE-2026-59875 CVE-2026-59875 in tar - Patched by Root
Root has patched CVE-2026-59875 in the tar package for Root:npm. Multiple fixed versions available...
EUVD-2026-52226
NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection...
NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection
NLTK's package downloader in nltk/downloader.py does not verify file integrity after download and before extraction. The download flow at lines 789-825: 1. File is downloaded to a temp path via HTTP 2. os.replacetmpfilepath, filepath moves it to the final location line 799 3. Extraction begins vi...
GHSA-5WP5-5229-5G6Q NLTK: Missing Post-Download Integrity Verification Allows Malicious Package Injection
NLTK's package downloader in nltk/downloader.py does not verify file integrity after download and before extraction. The download flow at lines 789-825: 1. File is downloaded to a temp path via HTTP 2. os.replacetmpfilepath, filepath moves it to the final location line 799 3. Extraction begins vi...
CLSA-2026-1788878815 TuxCare security update for 90 packages (2 CVEs)
TuxCare rebuilt 90 packages to address 2 CVEs. Fixed in 9.4.50.v20221201-tuxcare.5...
CLSA-2026-1788875719 TuxCare security update for 39 packages (1 CVE)
TuxCare rebuilt 39 packages to address 1 CVE. Fixed in 10.1.18-tuxcare.7...
CLSA-2026-1788873744 TuxCare security update for 32 packages (11 CVEs)
TuxCare rebuilt 32 packages to address 11 CVEs. Fixed in 7.0.70-tuxcare.3...
CLSA-2026-1788873403 TuxCare security update for org.springframework.graphql (5 CVEs)
TuxCare rebuilt 2 org.springframework.graphql packages to address 5 CVEs. Fixed in 1.2.9-tuxcare.5...
CLSA-2026-1788869692 TuxCare security update for org.springframework (6 CVEs)
TuxCare rebuilt 24 org.springframework packages to address 6 CVEs. Fixed in 5.3.37-tuxcare.11...
CLSA-2026-1788868464 TuxCare security update for 2 packages (1 CVE)
TuxCare rebuilt 2 packages to address 1 CVE. Fixed in 2.16.105-tuxcare.3...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana12.4: grafana12.4-12.4.10-0.1.hum1 aarch64, x8664 grafana12.4-12.4.10-0.1.hum1.src src...
Malicious code in i18nexus-tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 558344f06c374c5eff9c870250d63a5e9f784ffe23f91182154d9c66c441ee0b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16045 Malicious code in i18nexus (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37d8dfb4ceaec110414441ebad5da37dad342ef653a20499504385d9db1ffdac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2026-16046 Malicious code in i18nexus-tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 558344f06c374c5eff9c870250d63a5e9f784ffe23f91182154d9c66c441ee0b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...