GHSA-CRHJ-59GH-8X96 vulnerabilities

Vulnerabilities for packages: rancher-fleet, apko, argocd-image-updater, argo-events, zarf, gitlab-runner, tfsec, xeol, kaniko, grype, scorecard, snyk-cli, pulumi-kubernetes-operator, k9s, nuclei, flux, nfpm, kubescape, pulumi-language-yaml, syft, kots, goreleaser, act, gitaly, grafana-alloy,...

CVE-2026-7258 vulnerabilities

Vulnerabilities for packages: php...

CVE-2026-8328 vulnerabilities

Vulnerabilities for packages: python...

GHSA-J989-FGGP-QGP5 vulnerabilities

Vulnerabilities for packages: python...

CVE-2026-6665 vulnerabilities

Vulnerabilities for packages: pgbouncer...

CVE-2026-7259 vulnerabilities

Vulnerabilities for packages: php...

Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft

In this article 1. Attack chain overview 1. Technical analysis 2. How GitHub took action to prevent further harm 2. Mitigation and protection guidance 1. Microsoft Defender XDR Detections 2. Microsoft Defender XDR Threat analytics 3. Advanced hunting 4. Indicators of Compromise IOC 3. References ...

Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft

In this article 1. Attack chain overview 1. Technical analysis 2. How GitHub took action to prevent further harm 2. Mitigation and protection guidance 1. Microsoft Defender XDR Detections 2. Microsoft Defender XDR Threat analytics 3. Advanced hunting 4. Indicators of Compromise IOC 3. References ...

MAL-2026-4220 Malicious code in web3-secrets-detector (npm)

A coordinated supply-chain attack comprising 10 npm packages published by maintainer ddjidd5640 [email protected] within a 48-hour window 2026-05-19T03:55Z – 2026-05-21T04:31Z. All packages masquerade as legitimate Web3/DeFi developer security tools MCP servers while silently exfiltrating...

Malicious code in web3-secrets-detector (npm)

A coordinated supply-chain attack comprising 10 npm packages published by maintainer ddjidd5640 [email protected] within a 48-hour window 2026-05-19T03:55Z – 2026-05-21T04:31Z. All packages masquerade as legitimate Web3/DeFi developer security tools MCP servers while silently exfiltrating...

RHSA-2026:19106 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Bulletin has no description...

RHSA-2026:15856 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Bulletin has no description...

GHSA-XM7R-268R-WW34 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-8572 vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-2GJ8-F8HJ-PWWH vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-8555 vulnerabilities

Vulnerabilities for packages: chromium...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible Engine, in ansible-engine 2.8.x before 2.8.15, and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation, even when the disablegpgcheck parameter is set to False—which is the default...

Astra Linux – Vulnerability in PackageKit

PackageKit’s apt backend mistakenly treats all local deb files as trustworthy. The apt security model is based on repository trust, not the contents of individual files. On sites where PolicyKit rules are configured, this could allow users to install malicious packages...

Astra Linux – Vulnerability in dpkg

In dpkg, the Debian package management system, versions prior to 1.21.8, 1.20.10, 1.19.8, and 1.18.26 are vulnerable to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include debian.tar, the in-place extraction process may...

Malicious code in @tailwind-core/webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7955094460738dc65288f88a3bb990c7d3ff52ed3683f11265b7072bd80aa4e3 Package @tailwind-core/webpack impersonates the legitimate Tailwind v4 webpack loader @tailwindcss/webpack. The README copies Tailwind Labs branding ...