Linux Distros Unpatched Vulnerability : CVE-2026-43390

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: nstree: tighten permission checks for listing Even privileged services should not necessaril...

MAL-2026-3652 Malicious code in supabase-javascript (npm)

Three malicious npm packages published by the superbase account implement a dual-vector supply chain attack. Each package bundles a 4.5 MB statically-linked, UPX-packed ELF binary at .claude/settings and a companion .claude/settings.json that registers the binary as a Claude Code SessionStart hoo...

Malicious code in supabase-javascript (npm)

Three malicious npm packages published by the superbase account implement a dual-vector supply chain attack. Each package bundles a 4.5 MB statically-linked, UPX-packed ELF binary at .claude/settings and a companion .claude/settings.json that registers the binary as a Claude Code SessionStart hoo...

Oracle Linux 10 : jq (ELSA-2026-16692)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-16692 advisory. - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing hash collisions Tenable has extracted the preceding description block direct...

Linux Distros Unpatched Vulnerability : CVE-2026-43457

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mctp: i2c: fix skb memory leak in receive path When 'midev-allowrx' is false, the newly allocated skb isn't consumed by netifrx, it needs to free the skb...

MAL-2026-3649 Malicious code in iceberg-javascript (npm)

Three malicious npm packages published by the superbase account implement a dual-vector supply chain attack. Each package bundles a 4.5 MB statically-linked, UPX-packed ELF binary at .claude/settings and a companion .claude/settings.json that registers the binary as a Claude Code SessionStart hoo...

AlmaLinux 8 : kernel-rt (ALSA-2026:16196)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:16196 advisory. kernel: Dirty Frag is a new universal Local Privilege Escalation LPE vulnerability in the Linux kernel CVE-2026-43284 Tenable has extracted the preceding...

Linux Distros Unpatched Vulnerability : CVE-2026-43347

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - arm64: dts: qcom: monaco: Reserve full Gunyah metadata region We observe spurious Synchronous External Abort exceptions ESR=0x96000010 and kernel crashes on...

RHEL 9 : golang (RHSA-2026:16497)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:16497 advisory. The golang packages provide the Go programming language compiler. Security Fixes: cmd/go: golang: Go golang and cmd/go: Arbitrary Code Execution via...

Important Photon OS Security Update - PHSA-2026-4.0-1015

Updates of 'gstreamer', 'gst-plugins-bad' packages of Photon OS have been released...

@n8n/ai-workflow-builder (1.21.0), @n8n/backend-common (1.21.0) +7 more potentially affected by CVE-2026-44792 via @n8n/api-types (1.21.0)

@n8n/api-types NPM version 1.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on @n8n/api-types and may be impacted: - @n8n/ai-workflow-builder 1.21.0 - @n8n/backend-common 1.21.0 - @n8n/backend-test-utils 1.21.0 - @n8n/chat-hub 1.14.0 - @n8n/db 1.21....

Embedded Malicious Code

@tanstack/ packages are vulnerable to Embedded Malicious Code. The vulnerability is due to misconfigured GitHub Actions workflows and cache poisoning weaknesses that allowed attackers to extract OIDC tokens and publish malicious package versions under a trusted identity...

CVE-2026-42403 vulnerabilities

Vulnerabilities for packages: wildfly...

GHSA-2HFH-9H53-QC24 vulnerabilities

Vulnerabilities for packages: wildfly...

GHSA-R6HF-G5X6-7PV9 Guardrails AI contains a code injection vulnerability in its Hub package installation mechanism

Guardrails AI thru 0.6.7 contains a code injection vulnerability CWE-94 in its Hub package installation mechanism. When installing validator packages via guardrails hub install, the system retrieves a manifest from the Guardrails Hub and dynamically executes a script specified in the postinstall...

acegisecurity:acegi-security-catalina (>=0.7.0, <=0.9.0), ch.qos.logback:logback-access (>=${parent.version}, <=0.8) +40 more potentially affected by CVE-2026-43515 via tomcat:catalina (>=4.0.6, <=5.5.23)

tomcat:catalina MAVEN version =4.0.6, =0.7.0, =$parent.version, =0.6, =3.2.10-1-sp3seam2hibernate5, =1.5, =1.0-m5, =1.0-m5, =1.0.0-rc1, =4.7.1, =4.7.2 - org.apache.geronimo.assemblies:geronimo-tomcat-minimal 1.2-beta - org.apache.geronimo.configs:ca-helper-tomcat 1.2-beta -...

10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3376 more potentially affected by CVE-2026-44294 via protobufjs (>=7.0.0, <=7.5.5)

protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =2.0.2, =3.3.3 and more Source cves: CVE-2026-44294 Source advisory: SNYK:JS-PROTOBUFJS-16643291...

10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3376 more potentially affected by CVE-2026-44293 via protobufjs (>=7.0.0, <=7.5.5)

protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =2.0.2, =3.3.3 and more Source cves: CVE-2026-44293 Source advisory: SNYK:JS-PROTOBUFJS-16643421...

10minions-engine (>=0.0.1, <=0.0.4), @0xr404/lol404 (>=1.1.0, <=1.1.6) +3376 more potentially affected by CVE-2026-44292 via protobufjs (>=7.0.0, <=7.5.5)

protobufjs NPM version =7.0.0, =0.0.1, =1.1.0, =1.0.1-beta.0, =0.0.2-beta.0, =1.0.0, =1.5.10, =0.10.1, =1.1.0, =6.0.0, =2.0.2, =3.3.3 and more Source cves: CVE-2026-44292 Source advisory: OSV:GHSA-FX83-V9X8-X52W...

@0xchain/telemetry (>=1.1.0-beta.8, <=1.1.0-beta.18), @20206205tech/nestjs-common (>=0.8.0, <=0.11.3) +1038 more potentially affected by CVE-2026-44292 via protobufjs (>=8.0.0, <=8.0.1)

protobufjs NPM version =8.0.0, =1.1.0-beta.8, =0.8.0, =1.0.0, =1.1.4, =0.3.1, =0.3.1, =0.7.1, =0.7.0, =0.8.0 and more Source cves: CVE-2026-44292 Source advisory: OSV:GHSA-FX83-V9X8-X52W...