612385 matches found
Security Bulletin: IBM Edge Data Collector uses multiple dependencies which are vulnerable to multiple CVEs.
Summary IBM Edge Data Collector uses pillow-12.2.0-cp314-cp314-manylinux227x8664.manylinux228x8664.whl, immutable-4.3.8.tgz, urllib3-2.6.3-py3-none-any.whl, form-data-4.0.5.tgz, pyjwt-2.12.1-py3-none-any.whl which are vulnerable to CVE-2026-54059, CVE-2026-54060, CVE-2026-55379, CVE-2026-55380,...
CVE-2026-25707
A flaw was found in libzypp. A remote attacker could exploit a relative path traversal vulnerability when processing repository metadata. By supplying malicious repositories, an attacker could overwrite arbitrary files on the system. This could lead to privilege escalation or a denial of service...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: prometheus3.5: prometheus3.5-3.5.5-0.6.hum1 aarch64, x8664 prometheus3.5-3.5.5-0.6.hum1.src src Security Fixes: prometheus3.5: CVE-2026-53669...
Malicious code in @wbnr/design (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dcfb8ede925ca9e0cf7574c2ba3f81ced56682ef6c54439cc00ad5fc5b960fd The package's preinstall lifecycle script runs automatically on npm install. It reads the installer's username from USER/USERNAME environment variabl...
MAL-2026-11196 Malicious code in @wbnr/design (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1dcfb8ede925ca9e0cf7574c2ba3f81ced56682ef6c54439cc00ad5fc5b960fd The package's preinstall lifecycle script runs automatically on npm install. It reads the installer's username from USER/USERNAME environment variabl...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python-pip: python-pip-wheel-26.2-0.1.hum1 noarch python3-pip-26.2-0.1.hum1 noarch python-pip-26.2-0.1.hum1.src src Security Fixes: python-pip: CVE-2026-13346...
pip: pip: Arbitrary file installation via malicious package indexes
A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to...
Malicious code in react-fast-refresh-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcca3ccc0a35a13d8b3f30ff6019ab57782882ada4e01b941fbee77ad1236115 Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json declares a postinstall hook...
MAL-2026-11366 Malicious code in react-fast-refresh-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bcca3ccc0a35a13d8b3f30ff6019ab57782882ada4e01b941fbee77ad1236115 Package typosquats a React/Meta-branded name and falsely attributes authorship to 'Meta Open Source'. Its package.json declares a postinstall hook...
ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17) +231 more potentially affected by CVE-2026-18570 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.1)
org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-18570 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752067...
ROOT-APP-NPM-GHSA-QRV3-253H-G69C GHSA-qrv3-253h-g69c in @rootio/pnpm - Patched by Root
Root has patched GHSA-qrv3-253h-g69c in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...
RHSA-2026:47768 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Bulletin has no description...
CVE-2026-13346
A flaw was found in pip. When processing doubly-encoded package URLs from malicious package indexes, pip incorrectly handles the file paths. A remote attacker could exploit this by convincing a user to download or install a package from such an index. This could allow for files to be installed to...
Malicious code in phabricator-client (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43e718b20986295f99dd35066e46d0be5629555dccab79a1727cd3f5044cb7a0 phabricator-client 99.0.4 is a single-file PyPI package whose only runtime effect on import is to resolve lobohunter.duckdns.org and open a TCP...
MAL-2026-11195 Malicious code in phabricator-client (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43e718b20986295f99dd35066e46d0be5629555dccab79a1727cd3f5044cb7a0 phabricator-client 99.0.4 is a single-file PyPI package whose only runtime effect on import is to resolve lobohunter.duckdns.org and open a TCP...
CLEANSTART-2026-KH48438 Security fixes in keycloak 26.5.7-r1
Package keycloak version 26.5.7-r1 fixes 24 vulnerabilities: CVE-2026-44893, CVE-2026-44249, CVE-2026-45416, CVE-2026-45536, CVE-2026-45673...
CLEANSTART-2026-QA27412 Security fixes in druid-exporter-fips 0.10-r4
Package druid-exporter-fips version 0.10-r4 fixes 8 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32283...
CLEANSTART-2026-VK07836 Security fixes in terragrunt-fips 0.94.0-r3
Package terragrunt-fips version 0.94.0-r3 fixes 13 vulnerabilities: CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283, CVE-2026-32283...