GHSA-MWM8-39RW-8826 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, pact-broker-docker-fips...

CVE-2026-79770 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, kube-logging-operator, pact-broker-docker, ruby3.4-rails, ruby4.0-rails, ruby3.2-rails, pact-broker-docker-fips, gitlab-rails-ce-fips, ruby3.3-rails...

GHSA-5JHF-FPP7-V2PV vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, kube-logging-operator, pact-broker-docker, ruby3.4-rails, ruby4.0-rails, ruby3.2-rails, pact-broker-docker-fips, gitlab-rails-ce-fips, ruby3.3-rails...

CVE-2026-79771 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, kube-logging-operator, pact-broker-docker, ruby3.4-rails, ruby4.0-rails, ruby3.2-rails, pact-broker-docker-fips, gitlab-rails-ce-fips, ruby3.3-rails...

GHSA-9HJ4-R449-HFVC vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.4-rails, ruby3.2-rails, pact-broker-docker-fips, logstash, cinc-auditor, logstash-fips, ruby3.3-rails...

CVE-2026-71847 vulnerabilities

Vulnerabilities for packages: pact-broker-docker, ruby3.4-rails, ruby3.2-rails, pact-broker-docker-fips, logstash, cinc-auditor, logstash-fips, ruby3.3-rails...

GHSA-5V8H-3H3Q-446P vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, kube-logging-operator, pact-broker-docker, ruby3.4-rails, ruby4.0-rails, ruby3.2-rails, pact-broker-docker-fips, commercial-gitlab-rails-ee, logstash, logstash-fips, ruby3.3-rails...

GHSA-8678-W3JW-XFC2 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, kube-logging-operator, pact-broker-docker, ruby3.4-rails, ruby4.0-rails, ruby3.2-rails, pact-broker-docker-fips, commercial-gitlab-rails-ee, logstash, logstash-fips, ruby3.3-rails...

GHSA-9CV2-CFXC-V4V2 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, kube-logging-operator, pact-broker-docker, ruby3.4-rails, ruby4.0-rails, ruby3.2-rails, pact-broker-docker-fips, commercial-gitlab-rails-ee, logstash, logstash-fips, ruby3.3-rails...

GHSA-P67V-3W7G-WJG7 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, kube-logging-operator, pact-broker-docker, ruby3.4-rails, ruby4.0-rails, ruby3.2-rails, pact-broker-docker-fips, commercial-gitlab-rails-ee, logstash, logstash-fips, ruby3.3-rails...

GHSA-PHWJ-RPRQ-35PP vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, kube-logging-operator, pact-broker-docker, ruby3.4-rails, ruby4.0-rails, ruby3.2-rails, pact-broker-docker-fips, commercial-gitlab-rails-ee, logstash, logstash-fips, ruby3.3-rails...

GHSA-WFPW-MMFH-QQ69 vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, kube-logging-operator, pact-broker-docker, ruby3.4-rails, ruby4.0-rails, ruby3.2-rails, pact-broker-docker-fips, commercial-gitlab-rails-ee, logstash, logstash-fips, ruby3.3-rails...

GHSA-WJV4-X9W8-WM3H vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, kube-logging-operator, pact-broker-docker, ruby3.4-rails, ruby4.0-rails, ruby3.2-rails, pact-broker-docker-fips, commercial-gitlab-rails-ee, logstash, logstash-fips, ruby3.3-rails...

GHSA-5PRR-V3J2-97MH vulnerabilities

Vulnerabilities for packages: gitlab-rails-ce, kube-logging-operator, pact-broker-docker, ruby3.4-rails, ruby4.0-rails, ruby3.2-rails, pact-broker-docker-fips, commercial-gitlab-rails-ee, logstash, logstash-fips, ruby3.3-rails...

Malicious code in autotel-pact (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea3afdb0cdd411bf4c5c61858c6eac81b3a321fad31613a01d8e1ba80c9a6642 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-5226 Malicious code in autotel-pact (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ea3afdb0cdd411bf4c5c61858c6eac81b3a321fad31613a01d8e1ba80c9a6642 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

A week in security (April 7 – April 13)

Last week on Malwarebytes Labs: The Pall Mall Pact and why it matters Child predators are lurking on dating apps, warns report Your 23andMe genetic data could be bought by China, senator warns WhatsApp for Windows vulnerable to attacks. Update now! Man accused of using keylogger to spy on...

The Pall Mall Pact and why it matters

The US State Department reportedly plans to sign an international agreement designed to govern the use of commercial spyware known as the Pall Mall Pact. The Pall Mall Pact, formally known as the Pall Mall Process, was initiated by France and the United Kingdom in February 2024. The goal of the...

ai.ancf.lmos:arc-graphql-spring-boot-starter (>=0.111.0, <=0.120.0), ai.ancf.lmos:arc-runner (>=0.111.0, <=0.120.0) +1123 more potentially affected by CVE-2024-7254 via com.google.protobuf:protobuf-java (>=4.0.0-rc-1, <=4.27.4)

com.google.protobuf:protobuf-java MAVEN version =4.0.0-rc-1, =0.111.0, =0.111.0, =0.6.5, =0.0.1.alpha23, =0.1.0-m22, =0.1.0-m22, =4.7.2, =4.7.2, =4.7.2, =4.7.2, =4.7.2, =4.7.2, =4.7.2, =4.7.2, =4.7.2, =4.7.5 and more Source cves: CVE-2024-7254 Source advisory: MEND:CVE-2024-7254...