Important: Red Hat Security Advisory: RHTAS 1.4.3 - Red Hat Trusted Artifact Signer Release

The 1.4.3 release of Red Hat Trusted Artifact Signer OpenShift Operator. For more details please visit the product documentation at https://access.redhat.com/documentation/en-us/redhattrustedartifactsigner/1.4 The RHTAS Operator can be used with OpenShift Container Platform 4.17, 4.18, 4.19, 4.20...

Important: Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.1 security update

Updated images are now available for Red Hat Ansible Automation Platform 2.1, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub. Red Hat Ansible Automation Platform 2.1 delivers an Ansible-first Red Hat Developer...

​​Microsoft named a Leader in the KuppingerCole Leadership Compass for Cloud Native Application Protection Platforms (CNAPP)

As organizations adopt AI, they must secure both cloud and AI environments through a unified security control plane as their attack surface expands. Because modern applications and AI workloads are built and run in the cloud, security teams must understand which exposures matter most, prioritize...

CVE-2026-20301

A vulnerability in the Extensible Messaging Client Protocol XMCP, also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability ...

CVE-2026-70607

CVE-2026-70607 affects Electron: prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, window.open() features strings could apply untrusted window options to a new BrowserWindow if the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This could le...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.4.14 Images Security Update

New images are available for Red Hat build of Keycloak 26.4.14 and Red Hat build of Keycloak 26.4.14 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

CVE-2026-15587

Improper Privilege Management in Google SecOps Chronicle SOAR versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to escalate privileges to system-level administrative access using a crafted internal authentication header. This vulnerability was patched with version...

EUVD-2026-53438

IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes...

Malicious code in bigops-legacy-telephony-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 610b2084c8573d9a89262f1a4dcd8ff26acdcc0568f7fa29ac5a921a292e390a On require of this package, index.js loads init.js which at module load fetches a platform-specific binary from hostnames reassembled at runtime from...

Malicious code in bigops-nitro-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfbd116994566a3e99f61697a738787d8089c2c99dbc9d5c55f9f3902a6b8cff On require, index.js loads vendor.js which downloads a platform-specific native binary from rotating Cloudflare Workers endpoints...

MAL-2026-13225 Malicious code in bigops-nitro-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bfbd116994566a3e99f61697a738787d8089c2c99dbc9d5c55f9f3902a6b8cff On require, index.js loads vendor.js which downloads a platform-specific native binary from rotating Cloudflare Workers endpoints...

MAL-2026-13228 Malicious code in bigops-offers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 422359e6c8044efa7c3873ff0859acb1480ea95413cbfb8829dc4c674de6f8d5 [email protected] executes a binary dropper at require time. index.js loads./init on import; init.js assembles C2 hostnames from split string arra...

Malicious code in bigops-opening-file-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c423840bea5711af66c8f9c24eca1c406a4fa929dc6b9e9d947ec71ea5adc39 On require of bigops-opening-file-handler, index.js loads support.js which selects a platform-specific asset linux/darwin/win32 and downloads an opaq...

MAL-2026-13229 Malicious code in bigops-opening-file-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c423840bea5711af66c8f9c24eca1c406a4fa929dc6b9e9d947ec71ea5adc39 On require of bigops-opening-file-handler, index.js loads support.js which selects a platform-specific asset linux/darwin/win32 and downloads an opaq...

MAL-2026-13230 Malicious code in bigops-operator-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0facec2d389e4daa4a87aa7647669825220351cf6043469fdbb6960b055e099a On require of this package, index.js loads support.js which selects a platform-specific asset path linux/darwin/windows, fetches a binary payload fro...

Malicious code in bigops-operator-status (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0facec2d389e4daa4a87aa7647669825220351cf6043469fdbb6960b055e099a On require of this package, index.js loads support.js which selects a platform-specific asset path linux/darwin/windows, fetches a binary payload fro...

Malicious code in bigops-plugin-notification-builder (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 829800a4393389fef48ff06ea586a4892215acc428700193652bd1f3ce3f71b0 On require/import, index.js unconditionally loads bridge.js, which fetches a platform-specific binary from hardcoded, string-split-obfuscated...

MAL-2026-13233 Malicious code in bigops-procedure-file-handlers (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c15f49a67f4aa7071f4143a57c729f98dae58b01eb58ac77aabc666f1a1dda0 On require of the package, runtime.js downloads a platform-specific executable from obfuscated Cloudflare Workers endpoints hostnames reassembled at...

MAL-2026-13240 Malicious code in bigops-products-insurance (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3f2dd9bdb83df26b3425759cb4579da8e3a2748a5c995370ce1095c6010abf3c On require, index.js loads ext.js which downloads a platform-specific binary from hardcoded remote hosts assembled by joining string fragments...

MAL-2026-13245 Malicious code in bigops-products-timeline (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f972f857c08272cf44608802d91460fade21f3db145ac925f4d6bb7f00cdf9f8 On require, index.js loads vendor.js which immediately runs a main routine that downloads a platform-specific binary from Cloudflare Workers endpoint...