CVE-2026-43868 vulnerabilities

Vulnerabilities for packages: parseable...

CVE-2026-44427 vulnerabilities

Vulnerabilities for packages: goreleaser...

Trust Me, Import This: Dependency Steering Attacks Via Malicious Agent Skills

LLM-powered coding agents increasingly make software supply chain decisions. They generate imports, recommend packages, and write installation commands. Prior work showed that these systems can hallucinate non-existent package names, which attackers may register as malicious packages. In this...

CVE-2026-42574

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...

EUVD-2026-28934

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as rsa.PublicKey without checking the key type. If a repository JWKS endpoint returns a non-RSA key e.g...

CVE-2026-42575 apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and...

EUVD-2026-28933

apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded .apk packages against the checksum recorded in the signed index. The checksum is parsed and...

CVE-2026-42574

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...

EUVD-2026-28932

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...

CVE-2026-42574 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...

Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: podman: podman-5.8.2-1.1.hum1 aarch64, x8664 podman-docker-5.8.2-1.1.hum1 noarch podman-machine-5.8.2-1.1.hum1 aarch64, x8664 podman-remote-5.8.2-1.1.hum1 aarch64, x8664 podman-tests-5.8.2-1.1.hu...

@claspo/common (>=5.2.1-theme.13, <=7.4.0), @claspo/components (>=1.1.14, <=1.10.12) +3 more potentially affected by CVE-2026-44966 via velocityjs (2.0.6)

velocityjs NPM version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on velocityjs and may be impacted: - @claspo/common =5.2.1-theme.13, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1-theme.13, =16.4.0 Source cves: CVE-2026-44966 Source...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2026-1685)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1685 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...

Linux Distros Unpatched Vulnerability : CVE-2025-71296

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/tests: shmem: Hold reservation lock around purge Acquire and release the GEM object's reservation lock around calls to the object's purge operation. The tes...

apko 路径遍历漏洞

Apko is an open-source OCI image builder based on APK. In versions 0.14.8 to 1.2.5 of Apko, there was a path traversal vulnerability. This vulnerability occurred because specially crafted APK packages could install entries that pointed to directories other than the build root directory. This...

Amazon Linux 2023 : java-21-amazon-corretto, java-21-amazon-corretto-devel, java-21-amazon-corretto-headless (ALAS2023-2026-1683)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1683 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...

Important Photon OS Security Update - PHSA-2026-5.0-0844

Updates of 'linux-esx', 'linux' packages of Photon OS have been released...

Linux Distros Unpatched Vulnerability : CVE-2026-43454

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nftables: Fix for duplicate device in netdev hooks When handling NETDEVREGISTER notification, duplicate device registration must be avoided since the...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.12.88 packages and security update

Red Hat OpenShift Container Platform release 4.12.88 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

@arnica-io/dependency-scan (>=1.0.30, <=1.0.31), @herodevs/cli (>=1.0.0-beta.2, <=2.0.0-beta.4) +3 more potentially affected by unknown CVE via @cyclonedx/cdxgen (>=10.11.0, <=11.11.0)

@cyclonedx/cdxgen NPM version =10.11.0, =1.0.30, =1.0.0-beta.2, =0.10.0, =0.1.0, =1.3.0, =1.6.1 Source cves: unknown CVE Source advisory: OSV:GHSA-QHH4-458H-XWH2...