Linux Distros Unpatched Vulnerability : CVE-2026-19154

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Skia in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially...

Linux Distros Unpatched Vulnerability : CVE-2026-19173

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a...

Linux Distros Unpatched Vulnerability : CVE-2026-19161

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data...

Linux Distros Unpatched Vulnerability : CVE-2026-19157

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:3513-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3513-1 advisory. - CVE-2026-7260: circular symbolic links in phar archives can lead to unbounded recursion and cause C stack exhaustion bsc1273077. ...

@ahmedwalid05/instagram-private-api (>=1.43.6-0, <=1.43.9), @alwaysmeticulous/cli (>=2.306.0, <=2.308.0) +161 more potentially affected by CVE-2026-71498 via re2 (>=1.8.4, <=1.26.0)

re2 NPM version =1.8.4, =1.43.6-0, =2.306.0, =2.306.0, =1.43.3, =0.1.0, =8.0.0, =8.1.31, =8.0.0, =8.0.0, =1.0.9, =0.0.0-semantic-release, =0.1.1, =1.1.0, =1.2.4 and more Source cves: CVE-2026-71498 Source advisory: OSV:GHSA-J4R3-HG7J-8CHG...

@0xwork/connect (0.1.8), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +1374 more potentially affected by CVE-2026-16633 via pdfjs-dist (>=5.6.205, <=6.1.200)

pdfjs-dist NPM version =5.6.205, =0.1.8-fix.3, =0.2.5, =1.0.0, =0.2.0, =0.0.0, =0.1.0, =0.0.11-alpha-20260329202526-cfad3bcbd829b82471d2d4fed4e49b2ef849cafb, =4.11.1, =0.0.4, =0.0.0-beta-20260819155526, =0.0.0-beta-20260820202238, =0.0.0-beta-20260819155526, =0.3.11-nightly-20260929013405 -...

@0xwork/connect (0.1.8), @3onedata/alsatian (>=0.1.8-fix.3, <=0.1.8-fix.5) +1374 more potentially affected by CVE-2026-16633 via pdfjs-dist (>=5.6.205, <=6.1.200)

pdfjs-dist NPM version =5.6.205, =0.1.8-fix.3, =0.2.5, =1.0.0, =0.2.0, =0.0.0, =0.1.0, =0.0.11-alpha-20260329202526-cfad3bcbd829b82471d2d4fed4e49b2ef849cafb, =4.11.1, =0.0.4, =0.0.0-beta-20260819155526, =0.0.0-beta-20260820202238, =0.0.0-beta-20260819155526, =0.3.11-nightly-20260929013405 -...

CVE-2026-12061 vulnerabilities

Vulnerabilities for packages: open-webui, nemo...

@aws/nx-plugin (>=1.0.0-rc.24, <=1.0.0-rc.33), @hublo/sentinel (>=1.1.0-alpha.3, <=1.4.3) +39 more potentially affected by CVE-2026-71476 via nx (>=23.0.0, <=23.0.1)

nx NPM version =23.0.0, =1.0.0-rc.24, =1.1.0-alpha.3, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.0-beta.0, =23.0.1 and more Source cves: CVE-2026-71476 Source...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.35), @142vip/vuepress (>=0.0.1-alpha.19, <=0.0.1-alpha.25) +220 more potentially affected by CVE-2026-71438 via mermaid (>=11.0.0, <=11.16.0)

mermaid NPM version =11.0.0, =0.0.1-alpha.23, =0.0.1-alpha.19, =0.0.0, =1.1.0, =2.1.0, =2.1.0, =0.1.0, =2.1.0, =2.1.0, =2.1.0, =2.0.2, =0.0.3, =0.7.9, =0.15.0, =0.25.2 - @changmao/reveal-md 6.1.4-chanmao0.0 and more Source cves: CVE-2026-71438 Source advisory: OSV:GHSA-C4C3-PG64-4M4V...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.35), @142vip/vuepress (>=0.0.1-alpha.19, <=0.0.1-alpha.25) +129 more potentially affected by CVE-2026-71437 via mermaid (>=11.5.0, <=11.16.0)

mermaid NPM version =11.5.0, =0.0.1-alpha.23, =0.0.1-alpha.19, =0.0.0, =1.1.0, =2.1.0, =2.1.0, =0.1.0, =2.1.0, =2.1.0, =2.1.0, =2.0.2, =0.0.3, =0.7.9, =0.16.0, =0.35.0, =1.0.3 and more Source cves: CVE-2026-71437 Source advisory: OSV:GHSA-3RRR-JR9J-H3Q3...

@142vip/vitepress (>=0.0.1-alpha.23, <=0.0.1-alpha.35), @142vip/vuepress (>=0.0.1-alpha.19, <=0.0.1-alpha.25) +220 more potentially affected by CVE-2026-71436 via mermaid (>=11.0.0, <=11.16.0)

mermaid NPM version =11.0.0, =0.0.1-alpha.23, =0.0.1-alpha.19, =0.0.0, =1.1.0, =2.1.0, =2.1.0, =0.1.0, =2.1.0, =2.1.0, =2.1.0, =2.0.2, =0.0.3, =0.7.9, =0.15.0, =0.25.2 - @changmao/reveal-md 6.1.4-chanmao0.0 and more Source cves: CVE-2026-71436 Source advisory: OSV:GHSA-2V8P-3F2J-5MP7...

@appweaver/core (>=1.1.6, <=1.6.1), @cappa/cli (>=0.11.1, <=0.12.0) +37 more potentially affected by CVE-2026-18427 via @fastify/static (>=10.1.0, <=10.1.2)

@fastify/static NPM version =10.1.0, =1.1.6, =0.11.1, =7.0.0-canary.3011, =7.0.0-canary.3011, =7.0.0-canary.3011, =7.0.0-canary.3011, =7.0.0-canary.3011, =7.0.0-canary.3011, =7.0.0-canary.3011, =7.0.0-canary.3011, =7.0.0-canary.3011, =0.0.4, =0.0.6 - @darthcav/ts-http-server 0.9.1 -...

How we took malware advisories beyond npm

A compromised package can steal credentials the moment you install it, and until recently, GitHub could only flag those in npm. Not anymore. This is the story of how the supply chain engineering team behind Dependabot expanded malware advisories to eight ecosystems by building on OpenSSF's shared...

Important: Red Hat Security Advisory: RHEL AI 3.3 RPM runtime CVE fix - aom

AIPCC Security Alerts identified CVEs in the 3.3 release of base-images. The CVEs are listed with a severity level of "Important" or higher. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...

Malicious code in @holocronlab/botruntime-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad15bd6ba410e0c0ca88ac22f1632a4b6707c4c66396c49c0ba90f906b19ae33 The package is published as a runtime for 'brt-built botruntime agents' and its client.d.ts describes the exported client as 'the authenticated...

MAL-2026-13419 Malicious code in @holocronlab/botruntime-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad15bd6ba410e0c0ca88ac22f1632a4b6707c4c66396c49c0ba90f906b19ae33 The package is published as a runtime for 'brt-built botruntime agents' and its client.d.ts describes the exported client as 'the authenticated...

CVE-2026-19041 MissionSquad mcp-api NPM Package Version packages.ts this.packageService.installPackage command injection

A vulnerability has been found in MissionSquad mcp-api up to 1.11.8. The impacted element is the function this.packageService.installPackage of the file src/controllers/packages.ts of the component NPM Package Version Handler. The manipulation leads to command injection. It is possible to initiat...

Malicious code in @trackunit/iris-app-sdk-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22e0a86ea25c65d4c79c952852d254c96966dbc20a2c1017ea29cde939c35b5c This version of @trackunit/iris-app-sdk-vite declares cross-keychain: ^1.1.0 in its package.json dependencies. cross-keychain is a package associated...