pkgxray v1.0.5

pkgxray — pre-install security for npm packages, MCP servers, and AI agents Inspect an npm package or MCP server before you install or connect to it, and get a deterministic, evidence-backed SAFE, REVIEW, or BLOCK verdict. Local, zero-dependency static analysis — normal scans never execute packag...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.1: grafana13.1-13.1.1-0.4.hum1 aarch64, x8664 grafana13.1-13.1.1-0.4.hum1.src src Security Fixes: grafana13.1: CVE-2026-18446...

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338

CVE-2026-67338 affects JupyterLab prior to 4.5.9. A stored cross-site scripting vulnerability resides in the Extension Manager where URI protocols in package metadata URLs are not validated. This allows an attacker to publish malicious PyPI packages with javascript: URLs in project metadata, enab...

EUVD-2026-51849

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

bitcoin-nostr-relay (0.1.1), kormir (>=0.1.0, <=1.0.11) +5 more potentially affected by unknown CVE via nostr (>=0.1.5, <=0.40.0)

nostr CARGO version =0.1.5, =0.1.0, =0.2.6, =0.0.1, =0.1.6, =0.19.0, =0.21.0 - nostr-web 0.1.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2026-0230...

RHSA-2026:42125 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Bulletin has no description...

Oracle Linux 7 : python-tornado (ELSA-2026-24342)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-24342 advisory. - Backport fix for CVE-2026-31958 Orabug: 39521310 Tenable has extracted the preceding description block directly from the Oracle Linux security...

openSUSE 16 Security Update : keybase-client (openSUSE-SU-2026:21492-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21492-1 advisory. Changes in keybase-client: - CVE-2026-39824: failure to reject ASCII-only Punycode-encoded labels Tenable has extracted the preceding description block...

Linux Distros Unpatched Vulnerability : CVE-2026-62941

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check...

Malicious Package

Overview fast-csv-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

GHSA-FJR4-X663-MWXC vulnerabilities

Vulnerabilities for packages: mlflow...

CVE-2026-55685 vulnerabilities

Vulnerabilities for packages: vitess...

GHSA-H8FP-F39C-Q6MH vulnerabilities

Vulnerabilities for packages: vitess...

@ahmedwalid05/instagram-private-api (>=1.43.6-0, <=1.43.9), @alwaysmeticulous/cli (>=2.306.0, <=2.308.0) +161 more potentially affected by CVE-2026-68499 via re2 (>=1.8.4, <=1.25.1)

re2 NPM version =1.8.4, =1.43.6-0, =2.306.0, =2.306.0, =1.43.3, =0.1.0, =8.0.0, =8.1.31, =8.0.0, =8.0.0, =1.0.9, =0.0.0-semantic-release, =0.1.1, =1.1.0, =1.2.4 and more Source cves: CVE-2026-68499 Source advisory: OSV:GHSA-6HXR-MR5R-9836...

Malicious code in aiprepkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b253f849a7c5b8df780b282a05d2928e8b6003f51564e6997ad881391b8ec58 The package's PyPI metadata and README advertise prompt-preparation and input-normalization utilities, but the only shipped module aiprepkit/deps.py ...

Malicious code in catalogai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccb9ff2c71a85c2bac770a874ed3c811e963ba9b3da37417fb600678d8119991 catalogai 0.1.2 presents itself as a semantic-search / AI-catalog library but the shipped modules perform browser credential theft and...

MAL-2026-11418 Malicious code in catalogai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ccb9ff2c71a85c2bac770a874ed3c811e963ba9b3da37417fb600678d8119991 catalogai 0.1.2 presents itself as a semantic-search / AI-catalog library but the shipped modules perform browser credential theft and...