apache-liminal (>=0.0.3rc1, <=0.0.5), apache-liminal-test-spark (0.0.0) +7 more potentially affected by CVE-2025-69872 via diskcache (3.1.1)

diskcache PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on diskcache and may be impacted: - apache-liminal =0.0.3rc1, =0.0.0, =7.0.0a1, =1.2.0, =4.1.0, =6.0.0, =0.2.5, =0.2.7 - mars-gym 0.1.0 Source cves: CVE-2025-69872 Source advisor...

MAL-2026-826 Malicious code in testppe-pkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 49f139a3af58a80c706b3bc4b6c38676411528f34be00c79351705767f39eaa4 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in testppe-pkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 49f139a3af58a80c706b3bc4b6c38676411528f34be00c79351705767f39eaa4 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

airflow-clickhouse-plugin (0.6.0), dataverk-airflow (>=0.3.18, <=0.3.23) +1 more potentially affected by CVE-2026-24098 via apache-airflow (2.0.2)

apache-airflow PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin 0.6.0 - dataverk-airflow =0.3.18, =11.8.0, =13.7.0 Source cves: CVE-2026-24098 Source advisory:...

example-pkg-naturalett (>=14.4.0, <=14.4.6) potentially affected by CVE-2026-24098 via apache-airflow (2.1.0)

apache-airflow PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - example-pkg-naturalett =14.4.0, =14.4.6 Source cves: CVE-2026-24098 Source advisory: OSV:GHSA-5G2W-9F8G-G5Q7...

apache-liminal (>=0.0.4rc1, <=0.0.5), apache-liminal-zion (>=0.0.0, <=2.0.0) +1 more potentially affected by CVE-2026-24098 via apache-airflow (2.1.2)

apache-airflow PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.4rc1, =0.0.0, =14.4.7, =14.7.0 Source cves: CVE-2026-24098 Source advisory: OSV:GHSA-5G2W-9F8G-G5Q7...

apache-liminal (>=0.0.1.post1, <=0.0.3.post1), apache-liminal-test-spark (0.0.0) +4 more potentially affected by CVE-2026-24098 via apache-airflow (1.10.12)

apache-airflow PYPI version 1.10.12 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - apache-liminal =0.0.1.post1, =0.0.1, =6.0.0, =0.1.0, =0.5.0a9, =0.6.0a15 Source cves: CVE-2026-24098 Source advisory:...

Malware in @jes4l/react-pkg

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-25145

melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file e.g., through pull request-driven CI or build-as-a-service scenarios could read arbitrary files from the host system. The...

CVE-2026-25140

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in...

CVE-2026-25121

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package e.g., via a compromised or typosquatte...

CVE-2025-61731

A flaw was found in cmd/go. An attacker can exploit this by building a malicious Go source file that uses the 'cgo pkg-config:' directive. This allows the attacker to write to an arbitrary file with partial control over its content, by providing a '--log-file' argument to the pkg-config command...

CVE-2026-25145: Improper Limitation of a Pathname to a Restricted Directory

melange allows users to build apk packages using declarative pipelines. From version 0.14.0 to before 0.40.3, an attacker who can influence a melange configuration file e.g., through pull request-driven CI or build-as-a-service scenarios could read arbitrary files from the host system. The...

CVE-2026-25121: Relative Path Traversal

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, a path traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package e.g., via a compromised or typosquatte...

CVE-2026-25140: Uncontrolled Resource Consumption

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before 1.1.1, an attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in...

BIT-GOLANG-2025-61731 Arbitrary file write using cgo pkg-config directive in cmd/go

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a...

PT-2026-5258

Name of the Vulnerable Software and Affected Versions TeamViewer DEX former 1E DEX versions prior to 24.5 Description A command injection issue exists in TeamViewer DEX formerly 1E DEX related to the 1E-Nomad-RunPkgStatusRequest instruction. Insufficient input validation allows attackers with...

AZL-78935 CVE-2025-61731 affecting package golang 1.25.7-1

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a...

AZL-98568 CVE-2025-61731 affecting package golang 1.27.1-1

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a...

UBUNTU-CVE-2025-61731

Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "cgo pkg-config:" directive in a Go source file provides command-line arguments to provide to the Go pkg-config command. An attacker can provide a...