CVE-2026-11403

A vulnerability in Sonatype Nexus Repository Manager's format-specific API key generation may allow a remote attacker to gain unauthorized access to repository operations as a targeted user. A format-specific API key realm NuGet API Key, Docker Bearer Token, or npm Bearer Token must be enabled an...

Important: Red Hat Security Advisory: git-lfs security update

An update for git-lfs is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2026-15697 svgdotjs svg.js npm Package API EventTarget.on prototype pollution

A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated...

CVE-2026-15697 svgdotjs svg.js npm Package API EventTarget.on prototype pollution

A vulnerability was found in svgdotjs svg.js up to 3.2.5. This affects the function EventTarget.on of the file svgdotjs/svg.js of the component npm Package API. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated...

CVE-2026-10672 Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)

subsys/net/lib/lwm2m/lwm2mpullcontext.c copied the firmware-update Package URI into a fixed static buffer context.uri, size CONFIGLWM2MSWMGMTPACKAGEURILEN, default 128 with memcpycontext.uri, uri, LWM2MPACKAGEURILEN, copying exactly the destination size with no length validation. The...

CVE-2026-10672

CVE-2026-10672 affects Zephyr LwM2M firmware Update pull: a memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN) into a 128-byte buffer, with no length validation, copies up to 128 bytes of a server URI and omits the NUL terminator. Subsequent strlen and CoAP/PROXY_URI parsing read past the end into a...

CVE-2026-10672 Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)

subsys/net/lib/lwm2m/lwm2mpullcontext.c copied the firmware-update Package URI into a fixed static buffer context.uri, size CONFIGLWM2MSWMGMTPACKAGEURILEN, default 128 with memcpycontext.uri, uri, LWM2MPACKAGEURILEN, copying exactly the destination size with no length validation. The...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

CVE-2026-59875 vulnerabilities

Vulnerabilities for packages: prism, npm, kubeflow-centraldashboard, actions-runner, kibana, graalvm, wazuh-dashboard, pulumi, gitlab-rails-ce, lerna, saf, opensearch-dashboards-fips, code-server, sqlpad, wazuh-dashboard-fips, opensearch-dashboards, gitlab-rails-ce-fips...

CVE-2026-59873 vulnerabilities

Vulnerabilities for packages: prism, npm, kubeflow-centraldashboard, actions-runner, kibana, graalvm, wazuh-dashboard, pulumi, gitlab-rails-ce, homepage, lerna, saf, opensearch-dashboards-fips, code-server, sqlpad, wazuh-dashboard-fips, opensearch-dashboards, gitlab-rails-ce-fips...

CVE-2026-59874 vulnerabilities

Vulnerabilities for packages: prism, npm, kubeflow-centraldashboard, actions-runner, kibana, graalvm, wazuh-dashboard, pulumi, gitlab-rails-ce, homepage, lerna, saf, opensearch-dashboards-fips, code-server, sqlpad, wazuh-dashboard-fips, opensearch-dashboards, gitlab-rails-ce-fips...

GHSA-GF2W-JQMQ-FCM8 vulnerabilities

Vulnerabilities for packages: python...

GHSA-9MC4-RQMQ-H467 vulnerabilities

Vulnerabilities for packages: python...

CVE-2026-59875 vulnerabilities

Vulnerabilities for packages: code-server, prism, kubeflow-centraldashboard, npm, saf, sqlpad, pulumi, lerna...

CVE-2026-59871 vulnerabilities

Vulnerabilities for packages: code-server, prism, kubeflow-centraldashboard, npm, saf, sqlpad, pulumi, lerna...

CVE-2026-59873 vulnerabilities

Vulnerabilities for packages: code-server, prism, kubeflow-centraldashboard, npm, saf, sqlpad, pulumi, lerna...

GHSA-3CFQ-4XX4-RMPG vulnerabilities

Vulnerabilities for packages: libssh2...

CVE-2026-55199 vulnerabilities

Vulnerabilities for packages: libssh2...

Malicious code in nodemon-plint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c287effa0f498762ab73bfc0e4428b4d0afbc05435b1613459f9024d0b97927 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10595 Malicious code in nodemon-plint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c287effa0f498762ab73bfc0e4428b4d0afbc05435b1613459f9024d0b97927 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...