614060 matches found
Photon OS 3.0: Nss PHSA-2024-3.0-0739
An update of the nss package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-3.0-0739. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid32637...
Malicious code in @uwr/colors (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91240d8fb55b7ed4730a41f3a334c633bf1a03afb649fd473cad0c0a25312847 The package's postinstall script reads the installer's machine hostname via os.hostname and performs a DNS lookup of...
MAL-2026-10179 Malicious code in @uwr/colors (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91240d8fb55b7ed4730a41f3a334c633bf1a03afb649fd473cad0c0a25312847 The package's postinstall script reads the installer's machine hostname via os.hostname and performs a DNS lookup of...
Malicious code in fkext-browser-min (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e56088bc1216133ce76ad6026b73c2fd6977f9c64ec1c2ab38234dc90403b2c The package runs vishu.js as a preinstall lifecycle hook on npm install. That script fetches the machine's public IP from api.ipify.org, collects...
MAL-2026-10183 Malicious code in fkext-browser-min (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e56088bc1216133ce76ad6026b73c2fd6977f9c64ec1c2ab38234dc90403b2c The package runs vishu.js as a preinstall lifecycle hook on npm install. That script fetches the machine's public IP from api.ipify.org, collects...
MAL-2026-10178 Malicious code in @broadpeak/smartlib-ad (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45df33d93645560085a7efe94308b0e3d846f30c829f2d2804bcdb1245626289 package.json declares preinstall: node index.js, which fires automatically on npm install. index.js loads childprocess/os/https, runs whoami and id,...
Malicious code in consumerweb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74612bbfc323641d0141b4f1b495d6ea5f9b52129f2391bf21c5fabf63702ca7 On npm install, both preinstall and postinstall lifecycle hooks execute index.js, which collects host reconnaissance os.hostname, os.userInfo.usernam...
MAL-2026-10181 Malicious code in consumerweb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 74612bbfc323641d0141b4f1b495d6ea5f9b52129f2391bf21c5fabf63702ca7 On npm install, both preinstall and postinstall lifecycle hooks execute index.js, which collects host reconnaissance os.hostname, os.userInfo.usernam...
MAL-2026-10182 Malicious code in express-guardian (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c911dfdf99f0c6e13cb9e55883a5c2e17cca0b78d3149e38c0cafb6320ea742 The package advertises itself as Express security middleware XSS/SQLi protection, input sanitization but the middleware returned to Express is a no-o...
CVE-2026-55852
Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked before extraction. This issue is fixed in versions 16.23.0 and 15.112.0...
GHSA-FPG8-7664-JC5Q melange: Incomplete package integrity verification allows data section substitution
Previously, Apko verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files that get installed. An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file...
melange: Incomplete package integrity verification allows data section substitution
Previously, Apko verified the control section hash .PKGINFO etc. against the signed APKINDEX, but never verified the data section hash the actual package files that get installed. An attacker who could compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file...
CVE-2026-55852 Frappe: TarSlip RCE in Package Import
Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked before extraction. This issue is fixed in versions 16.23.0 and 15.112.0...
CVE-2026-55852 Frappe: TarSlip RCE in Package Import
Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, TarSlip RCE was possible in Package Import because tarfile members were not sufficiently checked before extraction. This issue is fixed in versions 16.23.0 and 15.112.0...
CVE-2026-55852
Technical details are not publicly available in the provided documents. Monitor for updates.
MAL-2026-10175 Malicious code in chai-as-doc (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cecfd3091225b3667317dd9da8fd56c4f5e7fc675e17d52cda601898b3a50ec2 The package presents itself as pino-style logging middleware but on require spawns a detached Node child that runs lib/initializeCaller.js. That scri...
MAL-2026-10176 Malicious code in uncaxss (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector acda9720ae54881219c0fbcee73795be85877d292aa62662f7cb6b92e775f608 Package ships an obfuscated dist/index.js that is invoked from the postinstall lifecycle hook node dist/index.js. At install time, the script perform...
Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: python3.13: python3.13-3.13.14-1.4.hum1 aarch64, x8664 python3.13-debug-3.13.14-1.4.hum1 aarch64, x8664 python3.13-devel-3.13.14-1.4.hum1 aarch64, x8664 python3.13-freethreading-3.13.14-1.4.hum1...
GHSA-XRMC-C5CG-RV7X SafeInstall agent guard shell parsing can miss raw package execution
Summary SafeInstall CLI through 0.10.1 can fail to recognize some package-manager and registry-runner commands in its agent guard. Case-variant launcher names, leading file-descriptor redirections, and supported shell wrappers with options can cause a raw install command to receive no guard...
