Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: tar: tar-1.35-9.1.hum1 aarch64, x8664 tar-1.35-9.1.hum1.src src Security Fixes: tar: CVE-2026-18477...

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

UBUNTU-CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

EUVD-2026-51849

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338 JupyterLab before 4.5.9 Stored XSS via Extension Manager

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338

CVE-2026-67338 affects JupyterLab prior to 4.5.9. A stored cross-site scripting vulnerability resides in the Extension Manager where URI protocols in package metadata URLs are not validated. This allows an attacker to publish malicious PyPI packages with javascript: URLs in project metadata, enab...

MAL-2026-11425 Malicious code in nvtorch-oot-nightly (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92503f2178663997d57ffa45fbb89f4a55de70e94f66745b4edf283a98e830f The package's setup.py issues an install-time HTTP request to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/nvtorchootnightly...

Malicious code in nvtorch-oot-nightly (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92503f2178663997d57ffa45fbb89f4a55de70e94f66745b4edf283a98e830f The package's setup.py issues an install-time HTTP request to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/nvtorchootnightly...

MAL-2026-11426 Malicious code in trtllm-subdir-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d2babc3deb7dd71a0515beeb63a43a5ab1b24bea455226652da9ea9377d1e5f setup.py performs an unconditional HTTP GET to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/trtllmsubdirtest at install time...

RHSA-2026:43225 Red Hat Security Advisory: OpenShift Container Platform 4.15.67 packages and security update

Bulletin has no description...

CVE-2026-14292

The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, includin...

CVE-2026-14292

The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, includin...

CVE-2026-14292 WordPress Download Manager < 3.3.66 - Author+ Stored XSS via Package Title

The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, includin...

CVE-2026-14292

The CVE-2026-14292 entry concerns the WordPress plugin Download Manager (before 3.3.66). The issue is a lack of proper escaping of a package title in front-end templates, enabling stored XSS via a package title by users with the Author role or higher. Impact described: arbitrary JavaScript execut...

CVE-2026-56852 affecting package kata-containers-cc for versions less than 3.15.0.aks0-16

CVE-2026-56852 affecting package kata-containers-cc for versions less than 3.15.0.aks0-16. A patched version of the package is available...

CVE-2026-41606 affecting package thrift for versions less than 0.24.0-1

CVE-2026-41606 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-56850 affecting package nodejs for versions less than 24.18.1-1

CVE-2026-56850 affecting package nodejs for versions less than 24.18.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-58662 affecting package thrift for versions less than 0.24.0-1

CVE-2026-58662 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-58023 affecting package thrift for versions less than 0.24.0-1

CVE-2026-58023 affecting package thrift for versions less than 0.24.0-1. An upgraded version of the package is available that resolves this issue...