GHSA-CRPM-PXR9-5JCF vulnerabilities

Vulnerabilities for packages: firefox...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: glibc: compat-libpthread-nonshared-2.43-8.2.hum1 aarch64, x8664 glibc-2.43-8.2.hum1 aarch64, x8664 glibc-all-langpacks-2.43-8.2.hum1 aarch64, x8664 glibc-benchtests-2.43-8.2.hum1 aarch64, x8664...

RLSA-2026:22121 Important: golang security update

The golang packages provide the Go programming language compiler. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass due to checksum validation flaw via malicious module proxy...

Moderate: attr security update

The attr packages provide extended attributes, which can be used to store system objects like capabilities of executables and access control lists, as well as user objects. Security Fixes: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr CVE-2026-54371 For more details about...

RHCOS 4 : OpenShift Container Platform 4.15.68 (RHSA-2026:56910)

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:56910 advisory. - crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 - net/url: Incorrect parsin...

GHSA-G352-92JC-35RP vulnerabilities

Vulnerabilities for packages: firefox...

GHSA-W67G-5RQW-F597 vulnerabilities

Vulnerabilities for packages: cosmo-router-fips, op-geth, cilium, cilium-fips, rke2-runtime-fips, cloudflared, virt-handler, cluster-api, virt-controller, gpu-operator-fips, loki, kubevela, cloudflared-fips, etcd, amazon-cloudwatch-agent-fips, jitsucom-bulker, kubevela-fips, gpu-operator,...

CLSA-2026-1787672438 TuxCare security update for io.netty (6 CVEs)

TuxCare rebuilt 47 io.netty packages to address 6 CVEs. Fixed in 4.1.130.Final-tuxcare.4...

ROOT-OS-DEBIAN-12-CVE-2025-71088 CVE-2025-71088 in linux - Patched by Root

Root has patched CVE-2025-71088 in the linux package for Root:Debian:12. Multiple fixed versions available...

24 npm Packages Abuse unpkg Mirrors to Host Fake Cloudflare CAPTCHA Pages

Cybersecurity researchers have disclosed details of a new campaign that uses a cluster of 24 npm packages as free phishing infrastructure for redirecting to ClickFix-style fake CAPTCHA pages. "While the malware is simply a single HTML page inside the npm package, and while downloading it wouldn't...

RHBA-2022:3917 Red Hat Bug Fix Advisory: new packages: glibc

Bulletin has no description...

CVE-2026-75554

Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...

CVE-2026-50645 vulnerabilities

Vulnerabilities for packages: apache-tika...

CVE-2026-75554

CVE-2026-75554 is an Insufficient Session Expiration vulnerability in the OAuth token refresh grant of hex.pm (the Hackage Package Manager). The root cause lies in expand_repositories_scope/3 in lib/hexpm/permissions.ex, which only rewrites the literal repositories scope. Explicitly granted repos...

CVE-2026-75554 Explicit organization scopes survive token refresh after membership ends

Insufficient Session Expiration vulnerability in the OAuth token refresh grant in hexpm hexpm allows a user removed from an organization to keep reading its private packages. expandrepositoriesscope/3 in lib/hexpm/permissions.ex only rewrites the literal repositories scope, so an explicitly grant...

CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access

Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth clientcredentials grant, validatescopesagainstkey/2 in...

CVE-2026-75542

CVE-2026-75542 is an Incorrect Authorization flaw in the OAuth token endpoint of hex.pm (the Erlang/BEAM package registry). When an API key holding the repositories permission is exchanged for a token via the client_credentials grant, the function validate_scopes_against_key/2 in lib/hexpm_web/co...

EEF-CVE-2026-75542 OAuth token exchange grants repository scopes for organizations the principal cannot access

Summary Incorrect Authorization vulnerability in the OAuth token endpoint in hexpm hexpm allows an API key holding the repositories permission to read another organization's private packages. When an API key is exchanged for a token through the OAuth client\credentials grant,...

Astra Linux – Vulnerability in PackageKit

PackageKit’s apt backend mistakenly treats all local deb files as trustworthy. The apt security model is based on repository trust, not the contents of individual files. On sites where PolicyKit rules are configured, this could allow users to install malicious packages...

Astra Linux – Vulnerability in Ansible

A flaw was discovered in Ansible Engine, in ansible-engine 2.8.x before 2.8.15, and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation, even when the disablegpgcheck parameter is set to False—which is the default...