Moderate: attr security update

The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects. Security Fixes: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr CVE-2026-54371 For more details about...

RHCOS 4 : OpenShift Container Platform 4.15.68 (RHSA-2026:56910)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56910 advisory. - crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 - net/url: Incorrect parsin...

GHSA-G352-92JC-35RP vulnerabilities

Vulnerabilities for packages: firefox...

GHSA-W67G-5RQW-F597 vulnerabilities

Vulnerabilities for packages: verticadb-operator-fips, amazon-ssm-agent-fips, amazon-ssm-agent, virt-controller-fips, cluster-api-fips, eks-distro-fips, jitsucom-bulker, verticadb-operator, virt-launcher, redis-operator-fips, etcd-fips, cilium, cluster-api, virt-handler-fips,...

CLSA-2026-1787672438 TuxCare security update for io.netty (6 CVEs)

TuxCare rebuilt 47 io.netty packages to address 6 CVEs. Fixed in 4.1.130.Final-tuxcare.4...

24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages

Cybersecurity researchers have disclosed details of a new campaign that uses a cluster of 24 npm packages as free phishing infrastructure for redirecting to ClickFix-style fake CAPTCHA pages. "While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn't...

RHSA-2026:59361 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Bulletin has no description...

RHBA-2022:3917 Red Hat Bug Fix Advisory: new packages: glibc

Bulletin has no description...

CVE-2026-75554

Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...

CVE-2026-50645 vulnerabilities

Vulnerabilities for packages: apache-tika...

CVE-2026-75554

CVE-2026-75554 is an Insufficient Session Expiration vulnerability in the OAuth token refresh grant of hex.pm (the Hackage Package Manager). The root cause lies in expand_repositories_scope/3 in lib/hexpm/permissions.ex, which only rewrites the literal repositories scope. Explicitly granted repos...

EEF-CVE-2026-75554 Explicit organization scopes survive token refresh after membership ends

Summary Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicit...

CVE-2026-75554 Explicit organization scopes survive token refresh after membership ends

Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...

CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...

CVE-2026-75542

CVE-2026-75542 is an Incorrect Authorization flaw in the OAuth token endpoint of hex.pm (the Erlang/BEAM package registry). When an API key holding the repositories permission is exchanged for a token via the client_credentials grant, the function validate_scopes_against_key/2 in lib/hexpm_web/co...

EEF-CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access

Summary Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant,...

abraham3k (>=1.3.8, <=1.5.3), accutuning-helpers (>=1.0.32, <=1.0.33) +75 more potentially affected by CVE-2026-76843 via flair (>=0.4.5, <=0.15.1)

flair PYPI version =0.4.5, =1.3.8, =1.0.32, =0.0.1, =0.1.0, =0.0.6, =0.1.20, =0.1.0, =0.1.0, =0.0.1.1, =0.2.4, =0.1.1, =0.0.1rc2, =0.0.1rc3488056308109 and more Source cves: CVE-2026-76843 Source advisory: SNYK:PYTHON-FLAIR-19256938...

@diviops/mcp-server (1.5.40), @donadiosolutions/lcm (>=1.4.2, <=1.4.3) +18 more potentially affected by CVE-2026-75899 via fast-uri (>=3.1.2, <=3.1.5)

fast-uri NPM version =3.1.2, =1.4.2, =1.2.0, =1.4.18, =0.2.0-alpha.5, =0.1.0, =0.1.6, =0.16.2-cloud-1, =1.25.0, =0.1.5, =0.1.3, =3.38.11, =0.1.0, =0.1.0, =0.1.3 and more Source cves: CVE-2026-75899 Source advisory: SNYK:JS-FASTURI-19256873...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. On the 2.x branch, prior to versions 2.2.24 and 2.7.7, the status, reinstall, and remove commands, when used with packages installed from sources via Git that contain specially crafted branch names in the repository, could allow for the execution of...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible Engine, in ansible-engine 2.8.x before 2.8.15, and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation, even when the disablegpgcheck parameter is set to False—which is the default...