MAL-2026-11498 Malicious code in @custombots/custombot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b88fd82e9d147a4fad43b89bab0b975fe57714abf16356eb39ec0ae62dcc7949 index.js opens a TCP connection to a base64-obfuscated IP address decodes to 85.137.253.124:1111, spawns /bin/sh, and pipes the shell's...

GHSA-M4P7-R5RC-7G4J vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, py3-cassandra-medusa, mlflow, airflow, superset, kserve...

Linux Distros Unpatched Vulnerability : CVE-2026-67355

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the request host in the Domain field instead of marking cookies as...

Linux Distros Unpatched Vulnerability : CVE-2026-67354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allowredirects.referer setting...

Fedora 44 : curl (2026-e691fbbfe7)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e691fbbfe7 advisory. - Fix trailing dot domain super cookie CVE-2026-8924 - Fix SSH improper host validation CVE-2026-9547 - Fix password leak with netrc and user in URL...

Linux Distros Unpatched Vulnerability : CVE-2026-67338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata...

Fedora 44 : gh (2026-4e77362489)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-4e77362489 advisory. Update to 2.97.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Linux Distros Unpatched Vulnerability : CVE-2026-67316

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate...

libntpc1-1.2.5-1.1 on GA media (moderate)

libntpc1-1.2.5-1.1 on GA media Announcement ID: openSUSE-SU-2026:11417-1 Rating: moderate Cross-References: CVE-2026-18321 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed in the libntpc1-1.2.5-1....

Fedora 43 : nextcloud (2026-51116fe081)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-51116fe081 advisory. 34.0.2 Release Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for...

OPENSUSE-SU-2026:11436-1 golang-github-prometheus-prometheus-3.13.2-1.1 on GA media

These are all security issues fixed in the golang-github-prometheus-prometheus-3.13.2-1.1 package on the GA media of openSUSE Tumbleweed...

gio-branding-upstream-2.88.3-1.1 on GA media (moderate)

gio-branding-upstream-2.88.3-1.1 on GA media Announcement ID: openSUSE-SU-2026:11415-1 Rating: moderate Cross-References: CVE-2026-15588 CVSS scores: CVE-2026-15588 SUSE : 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L CVE-2026-15588 SUSE : 4.8...

CVE-2026-59884 vulnerabilities

Vulnerabilities for packages: airflow, dbt-bigquery, openstack-keystone-2025.2, openstack-keystone-2025.1, apache-beam-python-3.12-sdk, superset, localstack, mlflow, lmcache-cuda-12.8, kubeflow-pipelines, authentik, openstack-keystone-2026.1, kserve, wazuh-manager-fips, wazuh-manager,...

GHSA-M4P7-R5RC-7G4J vulnerabilities

Vulnerabilities for packages: airflow, dbt-bigquery, openstack-keystone-2025.2, openstack-keystone-2025.1, apache-beam-python-3.12-sdk, superset, localstack, mlflow, lmcache-cuda-12.8, kubeflow-pipelines, authentik, openstack-keystone-2026.1, kserve, wazuh-manager-fips, wazuh-manager,...

CVE-2026-54787 vulnerabilities

Vulnerabilities for packages: trivy, kyverno-notation-aws, tekton-chains, ko, zot, falcoctl, tkn, kubescape, goreleaser, zarf, policy-controller, skaffold, aactl, neuvector-sigstore-interface, spire-server, crossplane, trivy-operator, kyverno, flux-source-controller...

GHSA-WQQC-JJCQ-VFXM vulnerabilities

Vulnerabilities for packages: trivy, kyverno-notation-aws, tekton-chains, ko, zot, falcoctl, tkn, kubescape, goreleaser, zarf, policy-controller, skaffold, aactl, neuvector-sigstore-interface, spire-server, crossplane, trivy-operator, kyverno, flux-source-controller...

GHSA-WG4G-WM44-CH5J vulnerabilities

Vulnerabilities for packages: ipfs-cluster, rke2-runtime-fips, spegel-fips, ipfs-cluster-fips, telegraf, kubo, k3s, spegel, rke2-runtime, kubo-fips, livekit-egress...

CVE-2026-54909 vulnerabilities

Vulnerabilities for packages: ipfs-cluster, rke2-runtime-fips, spegel-fips, ipfs-cluster-fips, kubo, k3s, spegel, stunnerd, rke2-runtime, kubo-fips, livekit-egress...

MAL-2026-11427 Malicious code in pp-react-worldready (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7 package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads...

Malicious code in pp-react-worldready (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7 package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads...