611884 matches found
CVE-2026-59884 vulnerabilities
Vulnerabilities for packages: airflow, openstack-keystone-2025.1, wazuh-manager-fips, duplicity, lmcache-cuda-12.8, kserve, dbt-bigquery, openstack-keystone-2026.1, kubeflow-pipelines, localstack, authentik-fips, superset, wazuh-manager, mlflow, authentik, datahub-ingestion,...
GHSA-M4P7-R5RC-7G4J vulnerabilities
Vulnerabilities for packages: airflow, openstack-keystone-2025.1, wazuh-manager-fips, duplicity, lmcache-cuda-12.8, kserve, dbt-bigquery, openstack-keystone-2026.1, kubeflow-pipelines, localstack, authentik-fips, superset, wazuh-manager, mlflow, authentik, datahub-ingestion,...
CVE-2026-54787 vulnerabilities
Vulnerabilities for packages: spire-server, zot, aactl, falcoctl, flux-source-controller, tekton-chains, skaffold, kubescape, kyverno, tkn, policy-controller, crossplane, trivy, kyverno-notation-aws, ko, neuvector-sigstore-interface, trivy-operator, goreleaser, zarf...
GHSA-WQQC-JJCQ-VFXM vulnerabilities
Vulnerabilities for packages: spire-server, zot, aactl, falcoctl, flux-source-controller, tekton-chains, skaffold, kubescape, kyverno, tkn, policy-controller, crossplane, trivy, kyverno-notation-aws, ko, neuvector-sigstore-interface, trivy-operator, goreleaser, zarf...
GHSA-WG4G-WM44-CH5J vulnerabilities
Vulnerabilities for packages: rke2-runtime, kubo-fips, telegraf, spegel, ipfs-cluster, k3s, rke2-runtime-fips, spegel-fips, kubo, livekit-egress, ipfs-cluster-fips...
CVE-2026-54909 vulnerabilities
Vulnerabilities for packages: rke2-runtime, kubo-fips, spegel, stunnerd, ipfs-cluster, k3s, rke2-runtime-fips, spegel-fips, kubo, livekit-egress, ipfs-cluster-fips...
MAL-2026-11427 Malicious code in pp-react-worldready (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7 package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads...
Malicious code in pp-react-worldready (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6cd3313519c0ef5edb290227d7d183c3d5344473351bc10bcf6a5d09e51c32a7 package.json declares a preinstall hook that runs vishu.js on npm install. The script resolves the installer's public IP via api.ipify.org, reads...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: tar: tar-1.35-9.1.hum1 aarch64, x8664 tar-1.35-9.1.hum1.src src Security Fixes: tar: CVE-2026-18477...
CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
UBUNTU-CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
EUVD-2026-51849
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
CVE-2026-67338 JupyterLab before 4.5.9 Stored XSS via Extension Manager
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
CVE-2026-67338
CVE-2026-67338 affects JupyterLab prior to 4.5.9. A stored cross-site scripting vulnerability resides in the Extension Manager where URI protocols in package metadata URLs are not validated. This allows an attacker to publish malicious PyPI packages with javascript: URLs in project metadata, enab...
CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
bitcoin-nostr-relay (0.1.1), kormir (>=0.1.0, <=1.0.11) +5 more potentially affected by unknown CVE via nostr (>=0.1.5, <=0.40.0)
nostr CARGO version =0.1.5, =0.1.0, =0.2.6, =0.0.1, =0.1.6, =0.19.0, =0.21.0 - nostr-web 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0229...
MAL-2026-11425 Malicious code in nvtorch-oot-nightly (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92503f2178663997d57ffa45fbb89f4a55de70e94f66745b4edf283a98e830f The package's setup.py issues an install-time HTTP request to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/nvtorchootnightly...
Malicious code in nvtorch-oot-nightly (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92503f2178663997d57ffa45fbb89f4a55de70e94f66745b4edf283a98e830f The package's setup.py issues an install-time HTTP request to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/nvtorchootnightly...
MAL-2026-11426 Malicious code in trtllm-subdir-test (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d2babc3deb7dd71a0515beeb63a43a5ab1b24bea455226652da9ea9377d1e5f setup.py performs an unconditional HTTP GET to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/trtllmsubdirtest at install time...