GHSA-W246-X8QV-R8F5 vulnerabilities

Vulnerabilities for packages: python...

CVE-2026-17084 vulnerabilities

Vulnerabilities for packages: python...

GO-2026-6325 vulnerabilities

Vulnerabilities for packages: grafana...

MAL-2026-15869 Malicious code in mcp-consultasdeveiculos-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb4363d5425f97beac0872e7e266983ebf4734da51c66ff674227108762c762c Package bin/main script, invoked as npx -y mcp-consultasdeveiculos-client --token per the referenced upstream project's public instructions, reads...

Malicious code in mcp-consultasdeveiculos-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb4363d5425f97beac0872e7e266983ebf4734da51c66ff674227108762c762c Package bin/main script, invoked as npx -y mcp-consultasdeveiculos-client --token per the referenced upstream project's public instructions, reads...

[SECURITY] Fedora 43 Update: kernel-7.1.13-100.fc43

The kernel meta package...

[SECURITY] Fedora 43 Update: python-pip-25.1.1-19.fc43

pip is a package management system used to install and manage software packag es written in Python. Many packages can be found in the Python Package Index PyPI. pip is a recursive acronym that can stand for either "Pip Installs Packages" or "Pip Installs Python"...

[SECURITY] Fedora 44 Update: kernel-7.1.13-200.fc44

The kernel meta package...

MAL-2026-15868 Malicious code in @bx-ui-framework/microfrontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1680cbcfbae85350989b4d123a117deb73e45aad1ee7aa339cdcef34d3fbe30 package.json declares a runtime dependency microfrontend whose source is a bare HTTPS URL at...

CLEANSTART-2026-ZB03263 Netty is a network application framework for development of protocol servers and clients

Multiple security vulnerabilities affect the keycloak package. Netty is a network application framework for development of protocol servers and clients. See references for individual vulnerability details...

Malicious code in tsshare (PyPI)

The PyPI package tsshare is malicious. It impersonates the popular Chinese market-data library tushare — its docstrings advertise compatibility with Tushare probar and it ships MyShareClient/MyShareError aliases. tsshare/client.py conceals its default API endpoint by base64-decoding it at runtime...

MAL-2026-16013 Malicious code in agent-free (npm)

The npm package agent-free is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes t...

PT-2026-86429

Name of the Vulnerable Software and Affected Versions gRPC-Go versions prior to 1.82.2 gRPC-Go versions prior to 1.83.2 Description Servers created with xds.NewGRPCServer are susceptible to a Denial of Service DoS because the HTTP/2 server transport may accept RPCs missing both the :authority...

MAL-2026-16011 Malicious code in orbitron-tui (npm)

The npm package orbitron-tui is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes...

MAL-2026-16014 Malicious code in prime-coding-agent (npm)

The npm package prime-coding-agent is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. It is a pure-JS proxy dist/index.js: it reads the developer's provider API keys e.g. process.env.EXAAPIKEY, NVIDIAAPIKEY, configured provider...

Malicious code in agent-free (npm)

The npm package agent-free is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes t...

Malicious code in orbitron-tui (npm)

The npm package orbitron-tui is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. On use, the CLI reads the developer's LLM/provider API key - from environment variables e.g. EXAAPIKEY, NVIDIAAPIKEY and its own config - and routes...

Malicious code in prime-coding-agent (npm)

The npm package prime-coding-agent is malicious. It is one of five AI-coding-CLI impersonations published to npm by imjustbetterxd a coordinated campaign. It is a pure-JS proxy dist/index.js: it reads the developer's provider API keys e.g. process.env.EXAAPIKEY, NVIDIAAPIKEY, configured provider...

Fedora 43 : rust-webbrowser (2026-c23bf61520)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c23bf61520 advisory. Update to version 1.2.4. This includes a fix for RUSTSEC-2026-0257. Tenable has extracted the preceding description block directly from the Fedora security...

Fedora 43 : memcached (2026-38d8cd1c52)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-38d8cd1c52 advisory. Rebase to 1.6.45 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...