Malicious code in sql-limit-enforcer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f8126bab8131e5781af023537f7c5fc2456929c104f71312eeddcea358b5659 Package ships no legitimate functionality: package.json declares main=index.js which is absent from the tarball, and the only shipped source is...

MAL-2026-16151 Malicious code in sql-limit-enforcer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f8126bab8131e5781af023537f7c5fc2456929c104f71312eeddcea358b5659 Package ships no legitimate functionality: package.json declares main=index.js which is absent from the tarball, and the only shipped source is...

OESA-2026-3788 python-pip security update

%changelog Thu May 14 2026 markeryang [email protected] - 23.3.1-11 - Fix CVE-2026-3219 Security Fixes: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires...

OESA-2026-3786 python-pip security update

%changelog Thu May 14 2026 markeryang [email protected] - 23.3.1-11 - Fix CVE-2026-3219 Security Fixes: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires...

OESA-2026-3785 python-pip security update

%changelog Thu May 14 2026 markeryang [email protected] - 23.3.1-11 - Fix CVE-2026-3219 Security Fixes: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires...

ROOT-APP-NPM-GHSA-6V7Q-WJVX-W8WG GHSA-6v7q-wjvx-w8wg in basic-ftp - Patched by Root

Root has patched GHSA-6v7q-wjvx-w8wg in the basic-ftp package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-27699 CVE-2026-27699 in basic-ftp - Patched by Root

Root has patched CVE-2026-27699 in the basic-ftp package for Root:npm. Multiple fixed versions available...

CLSA-2026-1789400657 TuxCare security update for org.apache.httpcomponents (1 CVE)

TuxCare rebuilt 7 org.apache.httpcomponents packages to address 1 CVE. Fixed in 4.5-tuxcare.1...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

Malicious code in lpulogin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45e20ac78f11be43827182fe0907a1ca21cc0886163235aa9c5aeaae37ce8e88 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16161 Malicious code in meraz-project-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d3081e87039a0a1582330f353797d15ba12cdb1c17828ab2ee7224b7c1ac4809 On npm install, the declared postinstall script bin/postinstall.js runs trackProject, which collects the installer's hostname, OS username,...

MAL-2026-16160 Malicious code in lpulogin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45e20ac78f11be43827182fe0907a1ca21cc0886163235aa9c5aeaae37ce8e88 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in dilxztech (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7330106d003ad893142e55e4be733e0641a98ebbd832d496139197dd6e8e18fd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-16159 Malicious code in dilxztech (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7330106d003ad893142e55e4be733e0641a98ebbd832d496139197dd6e8e18fd The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Astra Linux – Vulnerability in node-minimatch

Minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and earlier are vulnerable to Regular Expression Denial of Service ReDoS when a glob pattern contains many consecutive wildcards followed by a literal character that does not...

Astra Linux – Vulnerability in edk2

EDK2’s Network Package is vulnerable to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of confidentiality...

Astra Linux – Vulnerability in edk2

EDK2’s Network Package is vulnerable to an infinite loop vulnerability when parsing a PadN option in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of availability...

Astra Linux – Vulnerability in Node-EJS

The ejs also known as Embedded JavaScript templates package in Node.js before version 3.1.10 lacked certain measures to prevent pollution...

Astra Linux – Vulnerability in edk2

NetworkPkg/IScsiDxe has remotely exploitable buffer overflows...

Astra Linux – Vulnerability in edk2

EDK2’s Network Package is vulnerable to a buffer overflow vulnerability when handling the Server ID option from a DHCPv6 proxy Advertise message. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Confidentiality, Integrity, and/or...