611949 matches found
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: trivy: trivy-0.72.0-0.1.3.hum1 aarch64, x8664 trivy-0.72.0-0.1.3.hum1.src src Security Fixes: trivy: CVE-2026-49834...
JLSEC-2026-804 Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package...
Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example, user-supplied input files. This...
ROOT-APP-NPM-CVE-2026-44489 CVE-2026-44489 in @rootio/axios - Patched by Root
Root has patched CVE-2026-44489 in the @rootio/axios package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2024-28863 CVE-2024-28863 in @rootio/tar - Patched by Root
Root has patched CVE-2024-28863 in the @rootio/tar package for Root:npm. Multiple fixed versions available...
Malicious code in zer0code (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f11a39a2be94308e553081d26ba71cf416858053c84e52674666ba6f4acbf0f Package ships Python files under skills/pentesting.py and tools/security/exploit.py that reference ping commands and shell-spawning primitives...
MAL-2026-11170 Malicious code in @finxsecdemo/utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be118b4cf0acab2c331cc37f68a19bdbdf2ac8423ef984a1cac5c9f4d21c1e7e The postinstall.js lifecycle script unconditionally issues an HTTPS GET and a DNS resolution against a hardcoded interact.sh/OAST subdomain...
Malicious code in @finxsecdemo/utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be118b4cf0acab2c331cc37f68a19bdbdf2ac8423ef984a1cac5c9f4d21c1e7e The postinstall.js lifecycle script unconditionally issues an HTTPS GET and a DNS resolution against a hardcoded interact.sh/OAST subdomain...
CVE-2026-16385 vulnerabilities
Vulnerabilities for packages: firefox, firefox-esr...
GHSA-XMQ2-CRJ6-VR9M vulnerabilities
Vulnerabilities for packages: firefox, firefox-esr...
GHSA-CG63-H6R4-GP45 vulnerabilities
Vulnerabilities for packages: firefox, firefox-esr...
CVE-2026-16384 vulnerabilities
Vulnerabilities for packages: firefox, firefox-esr...
GHSA-MMG7-4C9C-2R54 vulnerabilities
Vulnerabilities for packages: firefox, firefox-esr...
GHSA-H655-847G-Q4F7 vulnerabilities
Vulnerabilities for packages: xorg-server...
CVE-2026-16384 vulnerabilities
Vulnerabilities for packages: firefox...
GHSA-XMQ2-CRJ6-VR9M vulnerabilities
Vulnerabilities for packages: firefox...
GHSA-CG63-H6R4-GP45 vulnerabilities
Vulnerabilities for packages: firefox...
GHSA-H8WM-M326-VH8H vulnerabilities
Vulnerabilities for packages: firefox...
Malicious code in test2221 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6113dcb20ef051691e0cc0034132b94421604bd16a085229f75aae5c612a3d9 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail over plain HTTP, sending the...
MAL-2026-11192 Malicious code in test2221 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f6113dcb20ef051691e0cc0034132b94421604bd16a085229f75aae5c612a3d9 package.json declares preinstall and postinstall lifecycle scripts that run curl against http://54.37.234.136/voicemail over plain HTTP, sending the...
CVE-2026-63227
An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP webshell to a publicly accessible directory and execute arbitrary code on the server...