SUSE SLED15: MozillaThunderbird / MozillaThunderbird-translations-common / etc (SUSE-SU-2026:2852-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2852-1 advisory. This update for MozillaThunderbird fixes the following issues Update to Firefox 140.12.0 ESR MFSA 2026-58,...

Security Bulletin: NVIDIA TensorRT-LLM - July 2026

NVIDIA has released a software update for NVIDIA® TensorRT-LLM. To protect your system, clone or update this software from the NVIDIA/TensorRT-LLM GitHub repo. Go to NVIDIA Product Security. Details The following table summarizes the potential vulnerabilities that this security update addresses a...

MAL-2026-10510 Malicious code in type-astr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 89817054cec44ec8ba09dd26af025483096055c0a931172bd4a63910dceb87fc The package presents itself as a pino-compatible logger exports a middleware aliased as pino, ships pino-like files such as proto.js, redaction.js,...

MAL-2026-10511 Malicious code in type-swap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6db27d60a7dec38dafef8ed810203dc0130cf340eae162410dfcb7b21a4e2658 The package's declared main entry index.js exports a middleware factory that, when invoked by a consumer, spawns lib/caller.js as a detached child...

MAL-2026-10504 Malicious code in chai-as-verified (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fece219fd09d83bc6a41135483cf3ce8cd2769c22e7776c22d0eb97d65852dd5 Package name typosquats chai-as-promised while its package.json advertises unrelated logger/vulnerability-management metadata. On require, index.js...

MAL-2026-10505 Malicious code in express-ini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 901c68ddbe24451843ae250e4fa71b40b1d4f86d1c81a62bc8f313a55701b7d3 package.json declares postinstall=node index.js. index.js is heavily obfuscated obfuscator.io rotated string-array with RC4-based decoders hiding all...

MAL-2026-10501 Malicious code in filewisee (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 758d74e75086465a01c3837210bf5bafe22d86e6f087be963e39ccd62ed0b034 The package presents itself as a date-formatting utility and re-exports plausible date APIs format, formatISO, formatDate, formatTime from...

Malicious code in gamified-trading-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f24facab67c0c7bd4775a6081ee54f4fab3fa7a5dd93b52a87f1111088e5e501 The package advertises itself as a trading-gamification library XP, leaderboards, updateProgress/getLeaderboard but its source contains none of those...

MGASA-2026-0242 Updated firefox, firefox-l10n, rootcerts, nss packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Privilege escalation in the Graphics: WebRender component. CVE-2026-12289 Memory safety bug fixed in Firefox ESR 140.12. CVE-2026-12290 Use-after-free in the Networking: HTTP component. CVE-2026-12291 Incorrect boundary conditions in the Web Audi...

Updated thunderbird thunderbird-l10n packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Privilege escalation in the Graphics: WebRender component. CVE-2026-12289 Memory safety bug fixed in Thunderbird ESR 140.12. CVE-2026-12290 Use-after-free in the Networking: HTTP component. CVE-2026-12291 Incorrect boundary conditions in the Web...

Malicious code in assertcoreutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e53b085bfe045b4aeabe9ad77e1066ab0883f27304197377681191c3118b780 assertcoreutils impersonates the popular chai assertion library: the README, the chai keyword, the lib/chai/ directory layout, and lib/chai.js are...

MAL-2026-10486 Malicious code in @omniwatch-wick/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e77b823fd6a050959af05f24e75f87cad447ab83a65c31349c7a559502af278c index.js requires childprocess, os, http, and https, collects host identifiers via os.userInfo, hostname, and process.platform, and POSTs the collect...

MAL-2026-10470 Malicious code in @uw010010/vite-tree (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 280687ad50e03b43bf7f26df6afb1a8fb794eb486c126b2368f37c6b76625318 The package @uw010010/vite-tree impersonates the upstream vite package: its package.json verbatim copies vite's author 'Evan You', description...

firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape in the Security: Process Sandboxing component...

firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure, sandbox escape in the Security: Process Sandboxing component...

firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure, sandbox escape in the Security: Process Sandboxing component...

PYSEC-2026-2494 Glances has arbitrary file write and command execution via `secure_popen` redirection and chaining operators in AMP command configuration

Summary The securepopen function in glances/secure.py interprets file redirection, | pipe, and && command chaining operators in command strings. These operators are applied without any validation on the target file path, piped command, or chained command. When Application Monitoring Process AMP...

PYSEC-2026-2418 CKAN has CSRF exemption primed by anonymous requests

Views can be marked as exempt from CSRF protection Access to the views via tokens or unauthenticated requests marked the endpoint as not requiring CSRF protection. The marking was a member variable in flask-wtf.csrf.CSRFProtect, which was stored as a module level variable in the flaskapp...

PYSEC-2026-2742 Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite

Summary Any authenticated user can overwrite any file's content by ID through the POST /api/v1/retrieval/process/files/batch endpoint. The endpoint performs no ownership check, so a regular user with read access to a shared knowledge base can obtain file UUIDs via GET /api/v1/knowledge/id/files a...

Malicious code in @oliviamcdaniel12/safer-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55129478b44191f3a4bb3308036567d5e2eb1a73084511b424917b6b5f7bf50f Package impersonates the popular safer-buffer module. On require, safer.js reads a PID from Porting-Buffer.md and, if that process is not alive, spaw...