GHSA-C97M-VXHJ-P7J6 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, crossplane-provider-aws-firehose, osv-scanner, crossplane-provider-aws-sns, mods, crossplane-provider-aws-rds, crossplane-provider-aws-ec2, crossplane-provider-aws-kinesis, crossplane-provider-azure-managedidentity,...

CVE-2026-5160 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, crossplane-provider-aws-firehose, osv-scanner, crossplane-provider-aws-sns, mods, crossplane-provider-aws-rds, crossplane-provider-aws-ec2, crossplane-provider-aws-kinesis, crossplane-provider-azure-managedidentity,...

GHSA-JPJM-C3R5-Q96R vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, amazon-cloudwatch-agent-operator, go-licenses, nsc, thanos, boring-registry, frp, splunk-otel-collector, kafkaexporter, caddy, amazon-cloudwatch-agent, rancher-machine, terraform-provider-grafana, terraform-provider-pagerduty,...

CVE-2026-56852 vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, amazon-cloudwatch-agent-operator, go-licenses, nsc, thanos, boring-registry, frp, splunk-otel-collector, kafkaexporter, caddy, amazon-cloudwatch-agent, rancher-machine, terraform-provider-grafana, terraform-provider-pagerduty,...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: hugo: hugo-0.164.0-0.1.2.hum1 aarch64, x8664 hugo-0.164.0-0.1.2.hum1.src src Security Fixes: hugo: CVE-2026-56852...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: capstone: capstone-5.0.8-0.1.hum1 aarch64, x8664 capstone-devel-5.0.8-0.1.hum1 aarch64, x8664 capstone-java-5.0.8-0.1.hum1 noarch capstone-static-5.0.8-0.1.hum1 aarch64, x8664...

OPENSUSE-SU-2026:21425-1 Security update for PackageKit

This update for PackageKit fixes the following issues: Security issue fixed: - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Non security issue fixed: - KDE Discover ignores package locks bsc1263252...

SUSE-SU-2026:22860-1 Security update for PackageKit

This update for PackageKit fixes the following issues: Security issue fixed: - CVE-2026-10294: manipulation of the argument frontend-socket can lead to improper authorization bsc1267250. Non security issue fixed: - KDE Discover ignores package locks bsc1263252...

MAL-2026-10993 Malicious code in torch-musa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 dc7f99306afb7d31dab4c2ca32f2feb984bcdc505cf1dc6c3ee736cd21f9bcc9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Moderate: Red Hat Security Advisory: libpng12 security update

An update for libpng12 is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: opentofu1.10: opentofu1.10-1.10.10-0.3.hum1 aarch64, x8664 opentofu1.10-1.10.10-0.3.hum1.src src Security Fixes: opentofu1.10: CVE-2026-56852...

Malicious code in kijai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86481ee3f08109eeaec60a41afb7c2e8d03efd680cc5bf846bdc342ec4205205 The package advertises itself as a high-throughput bulk-mail tool and ships every one of its 50 JS files cli.js, denv.js, helpers.js, all commands/.j...

MAL-2026-11014 Malicious code in kijai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86481ee3f08109eeaec60a41afb7c2e8d03efd680cc5bf846bdc342ec4205205 The package advertises itself as a high-throughput bulk-mail tool and ships every one of its 50 JS files cli.js, denv.js, helpers.js, all commands/.j...

ROOT-APP-NPM-CVE-2026-59940 CVE-2026-59940 in @rootio/seroval - Patched by Root

Root has patched CVE-2026-59940 in the @rootio/seroval package for Root:npm. Multiple fixed versions available...

Malicious code in calvora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc3f7e9ef1bbc85d0303406eac1b28cace865d65ab2bbad1104ba2f0adaaa78 index.mjs auto-invokes a sync routine at module import. Under Linux with NODEENV!= production and access to a WSL /mnt/c mount, it locates a Windows...

MAL-2026-11010 Malicious code in calvora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3bc3f7e9ef1bbc85d0303406eac1b28cace865d65ab2bbad1104ba2f0adaaa78 index.mjs auto-invokes a sync routine at module import. Under Linux with NODEENV!= production and access to a WSL /mnt/c mount, it locates a Windows...

Malicious code in calmora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e18af070089392b367436cc347aa8b436273c45c3a1f793232788f844505d63e On import of the package's main entry, a top-level IIFE gated to Linux hosts detects a WSL environment by probing /mnt/c, locates the Windows user...

Malicious code in vantora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b247c0aaff056911572cd72fb377332194aa11aa4ada038039e3c35a6755e2a The package [email protected] 6 files exhibits no observable supply-chain attack behavior. There are no lifecycle scripts fetching or executing remote...

Malicious code in veldora (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a848da2622d0adc27e55e1a650c39892aea7ef22c81c4c6ed4e5b6dc64809de Package [email protected] was scanned across 6 files. No evidence of install-time or import-time execution of remote content, no credential or environmen...

Malicious code in caldryn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95c9be7dd8b0d1fe026c48f500d432db06ebfb7bbb0721e3b1426cd29940fd1e No a static rule matches and no traced behavioral findings were produced for this package version. There is no observed evidence of install-time or...