612412 matches found
OPENSUSE-SU-2026:11400-1 tomcat10-10.1.57-1.1 on GA media
These are all security issues fixed in the tomcat10-10.1.57-1.1 package on the GA media of openSUSE Tumbleweed...
MAL-2026-11101 Malicious code in motion-forge-css (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f9c883a4865db328dff8b43c279a353b6ad494416a665e0201fdca7b6ba4daa Package advertises itself as a small PostCSS vendor-prefix / CSS-variable-injection plugin but ships a single 105KB obfuscator.io-packed bundle as it...
Malicious code in motion-forge-css (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f9c883a4865db328dff8b43c279a353b6ad494416a665e0201fdca7b6ba4daa Package advertises itself as a small PostCSS vendor-prefix / CSS-variable-injection plugin but ships a single 105KB obfuscator.io-packed bundle as it...
@robit/oaai (>=0.1.0, <=0.2.0), hdra-ai (>=0.1.0, <=0.2.0) +2 more potentially affected by unknown CVE via open-agents-ai (0.187.596)
open-agents-ai NPM version 0.187.596 is affected by a known vulnerability. The following packages have a transitive dependency on open-agents-ai and may be impacted: - @robit/oaai =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: unknown CVE Source advisory: SNYK:JS-OPENAGENTSAI-18550671...
@pmate/account-sdk (>=0.6.1, <=0.9.15), @pmate/agent-sdk (>=1.0.2, <=2.0.1) +2 more potentially affected by unknown CVE via @pmate/utils (1.1.4)
@pmate/utils NPM version 1.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on @pmate/utils and may be impacted: - @pmate/account-sdk =0.6.1, =1.0.2, =0.1.3, =0.12.0, =0.28.6 Source cves: unknown CVE Source advisory: SNYK:JS-PMATEUTILS-18550696...
venturo-playwright (1.0.13) potentially affected by unknown CVE via venturo-playwright-runner (1.0.9)
venturo-playwright-runner NPM version 1.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on venturo-playwright-runner and may be impacted: - venturo-playwright 1.0.13 Source cves: unknown CVE Source advisory: SNYK:JS-VENTUROPLAYWRIGHTRUNNER-18550644...
shadowmd-baileys (>=8.6.49, <=8.6.57) potentially affected by unknown CVE via @shadowmd/libsignal-node (8.6.59)
@shadowmd/libsignal-node NPM version 8.6.59 is affected by a known vulnerability. The following packages have a transitive dependency on @shadowmd/libsignal-node and may be impacted: - shadowmd-baileys =8.6.49, =8.6.57 Source cves: unknown CVE Source advisory: SNYK:JS-SHADOWMDLIBSIGNALNODE-185506...
@godscene/playground-electron (1.7.22), @godscene/visualizer (1.7.22) potentially affected by unknown CVE via @godscene/web (1.7.22)
@godscene/web NPM version 1.7.22 is affected by a known vulnerability. The following packages have a transitive dependency on @godscene/web and may be impacted: - @godscene/playground-electron 1.7.22 - @godscene/visualizer 1.7.22 Source cves: unknown CVE Source advisory: SNYK:JS-GODSCENEWEB-18550...
venturo-playwright (1.0.16) potentially affected by unknown CVE via venturo-playwright-runner (1.0.12)
venturo-playwright-runner NPM version 1.0.12 is affected by a known vulnerability. The following packages have a transitive dependency on venturo-playwright-runner and may be impacted: - venturo-playwright 1.0.16 Source cves: unknown CVE Source advisory: SNYK:JS-VENTUROPLAYWRIGHTRUNNER-18550644...
venturo-playwright (1.0.10) potentially affected by unknown CVE via venturo-playwright-runner (1.0.6)
venturo-playwright-runner NPM version 1.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on venturo-playwright-runner and may be impacted: - venturo-playwright 1.0.10 Source cves: unknown CVE Source advisory: SNYK:JS-VENTUROPLAYWRIGHTRUNNER-18550644...
datatran (1.5.0), log-serialize (2.1.1) potentially affected by unknown CVE via proto-bin (2.5.3)
proto-bin NPM version 2.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on proto-bin and may be impacted: - datatran 1.5.0 - log-serialize 2.1.1 Source cves: unknown CVE Source advisory: SNYK:JS-PROTOBIN-18385342...
Malicious Package
Overview anthropic-internal-tools is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Malicious code in cfgzen (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a904eba641878bae63f76595a468b0faaa66fd27104ac557249e457f005c3fb1 The package installs a site-wide cfgzen.pth containing import dotcfg, which Python's site machinery executes automatically at every interpreter start...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues
Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Operator package issues. We have performed updates to the Operators used by our Speech Services. The following vulnerabilities have been addressed in this update. Please read the details for remediation below. Vulnerability...
GHSA-4C8G-83QW-93J6 vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, unleash-proxy, kibana, wazuh-dashboard-fips, yaml-language-server, gitlab-rails-ce, keep, opensearch-dashboards-fips, keep-fips, vitess, nextcloud-server, opensearch-dashboards, wazuh-dashboard, arangodb, prism...
GHSA-V245-V573-V5VM vulnerabilities
Vulnerabilities for packages: gitlab-rails-ce-fips, gitlab-rails-ce, kibana...
CVE-2026-65617
A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions...
@aikidosec/broker-client (>=1.0.47, <=1.0.49), @kirick/ip (0.2.1) +4 more potentially affected by CVE-2026-54272 via ip-address (>=10.1.1, <=10.2.0)
ip-address NPM version =10.1.1, =1.0.47, =0.6.0, =2.0.0, =0.1.3, =7.6.5-beta.0, =8.0.3 Source cves: CVE-2026-54272 Source advisory: SNYK:JS-IPADDRESS-18343249...
EUVD-2026-49579
A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions...
