Malicious Package

Overview test-mal-npm-pkg-local is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview test-mal-npm-pkg-not-local is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview test-mal-npm-pkg-2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in test-mal-npm-pkg-not-local (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 803f42bec3cf0ba231262e882d9fb5def7e78c005b10e0c32edf60aecad5d9bf The package test-mal-npm-pkg-not-local was found to contain malicious code. Source: ghsa-malware...

Malware in test-mal-npm-pkg-not-local

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in test-mal-npm-pkg-local

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-29049: Uncontrolled Resource Consumption

melange allows users to build apk packages using declarative pipelines. In version 0.40.5 and prior, melange update-cache downloads URIs from build configs via io.Copy without any size limit or HTTP client timeout pkg/renovate/cache/cache.go. An attacker-controlled URI in a melange config can cau...

[SECURITY] Fedora 43 Update: apt-3.1.15-2.fc43

This package provides commandline tools for searching and managing as well as querying information about packages as a low-level access to all features of the libapt-pkg library. These include: apt-get for retrieval of packages and information about them from authenticated sources and for...

PT-2026-25101

Several extraction and scanning code paths registered late defers which could leak resources and exhaust system resources. This report is an aggregate of these individual reports for the affected code: Advisory | Affected File -- | -- GHSA-jjgh-mc5q-gch7 | pkg/action/scan.go GHSA-mwmf-fxh2-w4x7 |...

my-minpy-pkg (>=0.0.0.1, <=0.0.0.2) potentially affected by CVE-2026-28415 via gradio (4.2.0)

gradio PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - my-minpy-pkg =0.0.0.1, =0.0.0.2 Source cves: CVE-2026-28415 Source advisory: OSV:GHSA-PFJF-5GXR-995X...

my-minpy-pkg (>=0.0.0.1, <=0.0.0.2) potentially affected by CVE-2026-28414 via gradio (4.2.0)

gradio PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - my-minpy-pkg =0.0.0.1, =0.0.0.2 Source cves: CVE-2026-28414 Source advisory: OSV:GHSA-39MP-8HJ3-5C49...

my-minpy-pkg (>=0.0.0.1, <=0.0.0.2) potentially affected by CVE-2026-28415 via gradio (4.2.0)

gradio PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - my-minpy-pkg =0.0.0.1, =0.0.0.2 Source cves: CVE-2026-28415 Source advisory: OSV:PYSEC-2026-65...

my-minpy-pkg (>=0.0.0.1, <=0.0.0.2) potentially affected by CVE-2026-28416 via gradio (4.2.0)

gradio PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - my-minpy-pkg =0.0.0.1, =0.0.0.2 Source cves: CVE-2026-28416 Source advisory: OSV:PYSEC-2026-66...

my-minpy-pkg (>=0.0.0.1, <=0.0.0.2) potentially affected by CVE-2026-28414 via gradio (4.2.0)

gradio PYPI version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - my-minpy-pkg =0.0.0.1, =0.0.0.2 Source cves: CVE-2026-28414 Source advisory: OSV:PYSEC-2026-64...

MAL-2026-1044 Malicious code in awareness-demo-pkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 73d2724a4dc0c9e8d1439a29324b142a46c456e7d078ba90127777a59bf906d8 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

apache-liminal (>=0.0.1.post1, <=0.0.3.post1), apache-liminal-test-spark (0.0.0) +4 more potentially affected by CVE-2024-56373 via apache-airflow (1.10.12)

apache-airflow PYPI version 1.10.12 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.1.post1, =0.0.1, =6.0.0, =0.1.0, =0.5.0a9, =0.6.0a15 Source cves: CVE-2024-56373 Source advisory:...

edk2 security update

20241117-4.0.1.el97.3 - Replace upstream references Orabug:36569119 20241117-4.el97.3 - edk2-OvmfPkg-MemEncryptSevLib-Evict-cache-lines-during-SN.patch RHEL-125104 - edk2-MdePkg-Add-the-COHERENCYSFWNO-CPUID-bit-field.patch RHEL-125104 -...

MAL-2026-913 Malicious code in groq-ppe-pkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 517d20a09a1e53ce02484aa25ab2483ef75022e96f76d72fe3125bc1e16a359d Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2026-26187

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter pkg/block/local/adapter.go allows authenticated users to read and write files outside their designated storage boundaries. The verifyRelPath function used...

CVE-2026-26187: Improper Limitation of a Pathname to a Restricted Directory

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter pkg/block/local/adapter.go allows authenticated users to read and write files outside their designated storage boundaries. The verifyRelPath function used...